?
Solved

ARP question

Posted on 2004-09-06
6
Medium Priority
?
387 Views
Last Modified: 2013-11-29
Watching sniffer logs and saw this
http://mvpbaseball.cc/arp.jpg

The Ethernet II frame I captured lists "TYPE=ARP" in its "type" field. I thought the type field was used to identify upper layers?
Can someone elaborate?
Thanks!
0
Comment
Question by:dissolved
  • 2
  • 2
  • 2
6 Comments
 
LVL 7

Accepted Solution

by:
wparrott earned 1600 total points
ID: 11993383
Because ARP was designed as a MAC address resolver for many different protocols and not just IP, rides in the  same layer. Therefore it shows up in sniffers as an EtherType or Type as your image shows. This link should help explain further:

http://www.objectssearch.com/pedia/get.jsp?page=/wiki/Network_layer

Hope this helps...
0
 

Author Comment

by:dissolved
ID: 11993428
As quoted from page   "This layer is made up of two components. The first component is Logical Link Control. This component determines where one frame of data ends and the next one starts.In a snail-mail network, each letter is one frame of data, and you can tell where it begins and ends because it is inside anenvelope. You might also specify that a letter will begin with a phrase like "Dear Sir", and ends with a phrase like "YoursSincerely".


So this means that the data link layer has sub layers as I asked previously? MAC resolution is one? I know what ARP does, just wondering why it was showing up in the "TYPE" field of the ethernet II frame I captured. I was under the assumption only higher level layers show up in the "type" field of the datalink frames?
0
 
LVL 16

Assisted Solution

by:The--Captain
The--Captain earned 400 total points
ID: 11993574
>I was under the assumption only higher level layers show up in the "type" field of the datalink frames?

I think that's an incorrect assumption - ethereal (since that's what it looks like you're using) will put the most meaningful descriptor (ususally associated with the highest applicable layer) in the "Type" field (which in the case of that packet was "ARP) - it doesn't matter what layer to which "Type" refers.

IIRC, you can change the setting in "preferences" if it bothers you that much.

Cheers,
-Jon

0
Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

 
LVL 7

Expert Comment

by:wparrott
ID: 11993613
The previous poster is correct. I was trying to clarify this but it looks like he beat me to it.
0
 

Author Comment

by:dissolved
ID: 11995262
Is ethereal correct when it places "TYPE IP" in the ethernet II frame???
Thanks
0
 
LVL 16

Expert Comment

by:The--Captain
ID: 12009802
Since ARP is used to resolve IPs to MAC addresses, I'd say that's a yes.

Cheers,
-Jon

0

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question