Arp
 

Hello! Greetings from the land of Linux..:)

I am working on a lab in college. We are working with ethereal and doing telnet sessions. We have went through many exercises. This one is showing us what happens when an IP address doesn't exist. we are using the telnet command to go to an unkown IP address. There are several questions. The one we are hung up on is telling why the ARP Request packets are not transmitted (AKA encapsulated) like IP packets.

I would have to take an educated guess and my answer would be something to do with security. Our lab manual really doesn't help us with answering the question. So I was hoping someone else could

Melissa

Hi Melissa22 sounds like an interesting subject. Well for starters ARP stands for Address Resolution protocol, this as you might expect links the ip address to a mac address. Since it is dependent on the MAC protocol it is more assosiated with the MAC layer of the network stack, then the ip layer(reason 1 mac layer).

now simply, to use the tcp(ip sits ontop of this) protocol layer you must know 2 thinks your mac address and the other machines mac address(yes there are others). Now to find the other machines mac address you do a ARP broadcast with it's ip address in hope it will reply here is a tcpdump

20:06:43.282618 arp who-has 192.168.4.12 tell 192.168.4.10.


So basically since you don't know the 2 mac addresses you cannot use the tcp/ip protocol to find the other mac address(reason 2 cannot use ip with out the mac addresses)


:) hope that helps