Unit 3: Local networks · Lesson 2 of 7 · 16 min
ARP: from IP to MAC
Watch a laptop shout for a MAC address and read the answer in a capture.
mission
- You are
- The analyst explaining a slow login.
- Situation
- A user says the first page of the morning is always slow. You suspect the laptop is still finding its gateway.
- Goal
- Show the ARP exchange in the capture and explain each field.
- Hand in
- How many ARP requests the capture holds and the gateway's real MAC.
ARP as a town crier
Find a request and its reply
A request is broadcast to ff:ff:ff:ff:ff:ff. The reply comes straight back to the asker.
tshark -r arp.pcap -Y 'frame.number>=7 && frame.number<=8'
7 8.022166 02:42:0a:0a:00:17 → Broadcast ARP 42 Who has 10.10.0.31? Tell 10.10.0.23
8 8.022566 02:42:0a:0a:00:1f → 02:42:0a:0a:00:17 ARP 42 10.10.0.31 is at 02:42:0a:0a:00:1f
you should see The reply arrives 0.4 milliseconds later.
Read every field of a request
ARP sits straight inside Ethernet. There is no IP header at all, which is why it never leaves the local segment.
tshark -r arp.pcap -Y frame.number==1 -V | sed -n '/Address Resolution/,$p'
Address Resolution Protocol (request)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: 02:42:0a:0a:00:17 (02:42:0a:0a:00:17)
Sender IP address: 10.10.0.23
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.10.0.1
you should see Opcode 1 is a request. The target MAC is all zeros because that is the unknown.
Filters for this lesson
| Command | What it does |
|---|---|
arp | ARP packets only |
arp.opcode==1 | Requests: who has |
arp.opcode==2 | Replies: is at |
-e arp.src.proto_ipv4 -e arp.src.hw_mac | The IP and MAC the sender claims |
-e arp.dst.proto_ipv4 | The IP being asked about |
Count the requests
Counting is how you turn a capture into a statement you can put in a ticket.
tshark -r arp.pcap -Y 'arp.opcode==1' | wc -l
5
Count the replies
Normally every reply answers a request. Far more replies than requests means someone is sending answers nobody asked for.
tshark -r arp.pcap -Y 'arp.opcode==2' | wc -l
25
you should see 25 replies against only a handful of requests.
What a defender takes away
- 1ARP turns a local IP into a MAC with one broadcast and one reply.
- 2Replies are believed without any check.
- 3ARP never crosses a router, so you only see it from inside the segment.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.