Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

ARP question

Posted on 2004-09-06
6
Medium Priority
?
382 Views
Last Modified: 2013-11-29
Watching sniffer logs and saw this
http://mvpbaseball.cc/arp.jpg

The Ethernet II frame I captured lists "TYPE=ARP" in its "type" field. I thought the type field was used to identify upper layers?
Can someone elaborate?
Thanks!
0
Comment
Question by:dissolved
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
6 Comments
 
LVL 7

Accepted Solution

by:
wparrott earned 1600 total points
ID: 11993383
Because ARP was designed as a MAC address resolver for many different protocols and not just IP, rides in the  same layer. Therefore it shows up in sniffers as an EtherType or Type as your image shows. This link should help explain further:

http://www.objectssearch.com/pedia/get.jsp?page=/wiki/Network_layer

Hope this helps...
0
 

Author Comment

by:dissolved
ID: 11993428
As quoted from page   "This layer is made up of two components. The first component is Logical Link Control. This component determines where one frame of data ends and the next one starts.In a snail-mail network, each letter is one frame of data, and you can tell where it begins and ends because it is inside anenvelope. You might also specify that a letter will begin with a phrase like "Dear Sir", and ends with a phrase like "YoursSincerely".


So this means that the data link layer has sub layers as I asked previously? MAC resolution is one? I know what ARP does, just wondering why it was showing up in the "TYPE" field of the ethernet II frame I captured. I was under the assumption only higher level layers show up in the "type" field of the datalink frames?
0
 
LVL 16

Assisted Solution

by:The--Captain
The--Captain earned 400 total points
ID: 11993574
>I was under the assumption only higher level layers show up in the "type" field of the datalink frames?

I think that's an incorrect assumption - ethereal (since that's what it looks like you're using) will put the most meaningful descriptor (ususally associated with the highest applicable layer) in the "Type" field (which in the case of that packet was "ARP) - it doesn't matter what layer to which "Type" refers.

IIRC, you can change the setting in "preferences" if it bothers you that much.

Cheers,
-Jon

0
Understanding Web Applications

Without even knowing it, most of us are using web applications on a daily basis. Gmail and Yahoo email, Twitter, Facebook, and eBay are used by most of us daily—and they are web applications. We often confuse these web applications tools for websites.  So, what is the difference?

 
LVL 7

Expert Comment

by:wparrott
ID: 11993613
The previous poster is correct. I was trying to clarify this but it looks like he beat me to it.
0
 

Author Comment

by:dissolved
ID: 11995262
Is ethereal correct when it places "TYPE IP" in the ethernet II frame???
Thanks
0
 
LVL 16

Expert Comment

by:The--Captain
ID: 12009802
Since ARP is used to resolve IPs to MAC addresses, I'd say that's a yes.

Cheers,
-Jon

0

Featured Post

Plesk WordPress Toolkit

Plesk's WordPress Toolkit allows server administrators, resellers and customers to manage their WordPress instances, enabling a variety of development workflows for WordPress admins of all skill levels, from beginners to pros.

See why 2/3 of Plesk servers use it.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question