First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

ARP: can't see broadcast packets

  • retag add tags

System configurations:

  • Wireshark 3.2.3
  • Ubuntu 20.04
  • Wireless card in promiscuous mode

When I try to capture ARP packets I can notice two strange things:

  1. In the packets panel the ARP destination always contains my MAC address and not the word "Broadcast" even if within the packet the destination address is 00:00:00:00:00:00.
  2. I never see in the packets panel broadcast packets for IP addresses different than mine. In other words I can only see ARP request packet "Who has X?" where X is always my IP address (of course I can see my ARP replies)
zer0uno's avatar
1
zer0uno
asked 2023-02-27 22:21:35 +0000, updated 2023-02-27 23:05:21 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Perhaps 00:00;00:00:00:00 matches your machine due to a config file containing the match. A sample file would go a long way.

hugo.vanderkooij's avatar hugo.vanderkooij (2023-02-28 13:19:08 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

Does your wireless infrastructure have multicast-to-unicast or some such feature turned on? If enabled, this usually applies to all group traffic, which would be multicast and broadcast. So broadcast would be sent directly to your host via the 802.11 unicast mechanism, which has your MAC address as the destination at Layer2. You might not see other hosts ARP because some wifi systems learn MAC and IP addresses of clients, and will then filter appropriately.

Bob Jones's avatar
1.5k
Bob Jones
answered 2023-02-28 16:37:31 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer