Question about ARP protocol. In this video https://www.youtube.com/watch?v=iBOT_... (from 0:25). Can someone explain why in 15th and 16th frame there is ARP protocol again, asking for 192.168.1.11 MAC address, if that node already knows the MAC address (from the first and second frame) and it's even in the destination? Is it something with aging or second node just wants to check first nodes MAC address (is it still the same)?
It's a choice. Historiclly it was common to learn ARP as soon as you got a packet. As everyting what you need is in the SYN packet as soon as it arrives there is no point to ask for it it return a SYN/ACK packet.
Historically this make a lot of send if you have a lot of systems in 1 collision domain. But times have changed and so is the size of the average collision domain. So now you (sometimes) see both ends do ARP request for just a single TCP connection.
I understand this migh look akward but that is the way I have seen ARP packet change over the years.
It's difficult to see with all the 1's in the IP address.
Packets #1 and #2 are probably the ".11" node asking where the ".1" node before sending a ping.
Packet #15 and #16 are ".1" asking where ".11" is in order to send a ping response.
(Guessing that is ping traffic based on the rest of the packets in the list.)
#1: Who has 192.168.1.1? Tell 192.168.1.11
#2: 192.168.1.1. is at 08:00:27:e9:b4:2f
#15 Who has 192.168.1.11? Tell 192.168.1.1
#16: 192.168.1.11 is at 08:00:27:ef:bf:5e
If the nodes are on a /24 network the ping traffic is probably going through 192.168.1.1 to reach 192.168.2.21.
Comments