Wireshark · Ethereal-users: Re: [Ethereal-users] RARP not traced

[Richard J Moore <richardj_moore@xxxxxxxxxx>]

Yes, I see the ARP resps now.  I think that using port mirrorring to view
what was happening at the interfaces to a switch was getting in the way. If
I use tethereal from the cmdline I see the complete flow.
- -
Richard J Moore
IBM Advanced Linux Response Team - Linux Technology Centre
MOBEX: 264807; Mobile (+44) (0)7739-875237
Office: (+44) (0)1962-817072


                                                                           
             "Mike                                                         
             Armstrong"                                                    
             <mfa@xxxxxxxxx.                                            To 
             ufl.edu>               <ethereal-users@xxxxxxxxxxxx>, Richard 
                                    J Moore/UK/IBM@IBMGB                   
             01/03/2005                                                 cc 
             19:14                                                         
                                                                       bcc 
                                                                           
                                                                   Subject 
                                    [Ethereal-users] RARP not traced       
                                                                           
                                                                           




Here's a typical ARP sequence I see, using 0.10.9(C) under Windows:

   No.    Time                   Source                    Destination
Protocol   Info
   1786 13:57:37.755773 10.230.52.162        Broadcast               ARP
Who has 10.230.53.3?  Tell 10.230.52.162
   1787 13:57:37.755810 10.230.53.3           10.230.52.162         ARP
10.230.53.3 is at 00:08:02:58:51:56

Mike Armstrong
UF/IFAS CREC
Lake Alfred, FL