Wireshark-users: Re: [Wireshark-users] Ping not showing up

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 19 Jun 2007 22:33:56 +0200

On Tue, Jun 19, 2007 at 08:41:51PM +0200, someone somewhere wrote:
> 
> Today, my ISP was having some problems.  Before I knew that it was the ISP's fault, I ran wireshark but got some strange results.  I only got ARP and DHCP traffic when I was pinging a host with no success (by ip address, not dns name).  Why didn't at least the outgoing ping request show up ?  According to windows, I did have a valid ip address.

Did you ping something on your local network or something behind the default
gateway? If the first, were the arp's that you see for the ip-address that
you pinged? And did you get an arp reply on them? If the pinged address
was not on your local network, were the arp-packets arp-request for the
default gateway? Did you get a response?

In order for your system to ping a host, ie send an icmp-echo packet to
it, it needs to know what system to send it to. It can only send packets
to directly connected systems. In order to find out which system to send 
it too, it needs to have the mac-address of that system. Arp is used
to find the matching mac-address to an ip-address or the next hop towards
the ip-address.

I hope this helps, Cheers,


Sake