Solved

ARP question

Posted on 2004-09-06
6
339 Views
Last Modified: 2013-11-29
Watching sniffer logs and saw this
http://mvpbaseball.cc/arp.jpg

The Ethernet II frame I captured lists "TYPE=ARP" in its "type" field. I thought the type field was used to identify upper layers?
Can someone elaborate?
Thanks!
0
Comment
Question by:dissolved
  • 2
  • 2
  • 2
6 Comments
 
LVL 7

Accepted Solution

by:
wparrott earned 400 total points
ID: 11993383
Because ARP was designed as a MAC address resolver for many different protocols and not just IP, rides in the  same layer. Therefore it shows up in sniffers as an EtherType or Type as your image shows. This link should help explain further:

http://www.objectssearch.com/pedia/get.jsp?page=/wiki/Network_layer

Hope this helps...
0
 

Author Comment

by:dissolved
ID: 11993428
As quoted from page   "This layer is made up of two components. The first component is Logical Link Control. This component determines where one frame of data ends and the next one starts.In a snail-mail network, each letter is one frame of data, and you can tell where it begins and ends because it is inside anenvelope. You might also specify that a letter will begin with a phrase like "Dear Sir", and ends with a phrase like "YoursSincerely".


So this means that the data link layer has sub layers as I asked previously? MAC resolution is one? I know what ARP does, just wondering why it was showing up in the "TYPE" field of the ethernet II frame I captured. I was under the assumption only higher level layers show up in the "type" field of the datalink frames?
0
 
LVL 16

Assisted Solution

by:The--Captain
The--Captain earned 100 total points
ID: 11993574
>I was under the assumption only higher level layers show up in the "type" field of the datalink frames?

I think that's an incorrect assumption - ethereal (since that's what it looks like you're using) will put the most meaningful descriptor (ususally associated with the highest applicable layer) in the "Type" field (which in the case of that packet was "ARP) - it doesn't matter what layer to which "Type" refers.

IIRC, you can change the setting in "preferences" if it bothers you that much.

Cheers,
-Jon

0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 7

Expert Comment

by:wparrott
ID: 11993613
The previous poster is correct. I was trying to clarify this but it looks like he beat me to it.
0
 

Author Comment

by:dissolved
ID: 11995262
Is ethereal correct when it places "TYPE IP" in the ethernet II frame???
Thanks
0
 
LVL 16

Expert Comment

by:The--Captain
ID: 12009802
Since ARP is used to resolve IPs to MAC addresses, I'd say that's a yes.

Cheers,
-Jon

0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now