Wireshark-users: Re: [Wireshark-users] Hubs and Switches

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Wed, 04 Oct 2006 17:04:47 -0700

At 04:24 PM 10/4/2006, Stephen Fisher wrote:

On Wed, Oct 04, 2006 at 06:48:59PM -0400, Usman Qureshi wrote:

> I have a questions regarding ICMP packets traversing through Hubs and
> Switches.  If connected on a Hub I ping the broadcast address
> (192.168.0.255) from a host machine (192.168.0.100) I get a response
> from the address 192.168.0.1 with destination address as
> 192.168.0.100.  How is this possible? I do not have machine with the
> broadcast IP address.

When you ping the broadcast address, all hosts receive the packet and
some will act as if they were pinged directly.

Only if the Ethernet destination address is broadcast. ping will make the appropriate OS call to convert the IP address to an Ethernet MAC address, which might be broadcast or might not.

> On the other hand, when connected through a switch I do not get any
> replies and only see request packets on Ethereal.

It sounds like the hub you're using has the address 192.168.0.1 if you
no longer receive responses when using the switch.

A true hub has no knowledge of IP addresses or Ethernet MAC addresses. It sends all messages to all ports.