Wireshark · Ethereal-users: Re: [Ethereal-users] RARP not traced

[Richard J Moore <richardj_moore@xxxxxxxxxx>]

Thank you, that explains it.

Failure case was in same n/w. Wanted to compare good case to another n/w.

My mistake to assume RARP was the response.

Thanks.

- -
Richard J Moore
IBM Advanced Linux Response Team - Linux Technology Centre
MOBEX: 264807; Mobile (+44) (0)7739-875237
Office: (+44) (0)1962-817072


                                                                           
             Scott Lowrey                                                  
             <slowrey@nexton                                               
             e.com>                                                     To 
             Sent by:               Ethereal user support                  
             ethereal-users-        <ethereal-users@xxxxxxxxxxxx>          
             bounces@etherea                                            cc 
             l.com                                                         
                                                                       bcc 
                                                                           
             01/03/2005                                            Subject 
             12:48                  Re: [Ethereal-users] RARP not traced   
                                                                           
                                                                           
             Please respond                                                
               to Ethereal                                                 
              user support                                                 
                                                                           
                                                                           




ARP and RARP are two different things.  RARP is not involved in this case.

Is the device being pinged on the same network as the host sending the
ping?  If not, there will be no reply to the ARP and the host will
forward the ICMP packet to the default router.

It is necessary to use ARP to find the default router's MAC address,
too, and you may see an ARP request/reply transaction there.  But if the
default router as received any other traffic recently, it's MAC address
is in the host ARP cache already -- no request will be sent. If this is
the case, you will only see one unanswered ARP request.

Are any capture or read filters being used?

Can you capture on the device responding to the ping?  If it is on the
same LAN, do you see the incoming ARP request and the outgoing reply?

Richard J Moore wrote:

>
>
>I have traced a successful ping. I see the ARP requests, but I never see
>any responses. Why is this? My version of ethereal is 0.10.0a on RHEL3
>Linux. (2.4.21-9.0.1-EL kernel).
>
>Any insights would be appreciated.
>- -
>Richard J Moore
>IBM Advanced Linux Response Team - Linux Technology Centre
>MOBEX: 264807; Mobile (+44) (0)7739-875237
>Office: (+44) (0)1962-817072
>
>_______________________________________________
>Ethereal-users mailing list
>Ethereal-users@xxxxxxxxxxxx
>http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
>
>

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users