Ethereal-users: Re: [Ethereal-users] RARP not traced

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Scott Lowrey <slowrey@xxxxxxxxxxx>
Date: Tue, 01 Mar 2005 07:48:13 -0500
ARP and RARP are two different things.  RARP is not involved in this case.

Is the device being pinged on the same network as the host sending the ping? If not, there will be no reply to the ARP and the host will forward the ICMP packet to the default router. It is necessary to use ARP to find the default router's MAC address, too, and you may see an ARP request/reply transaction there. But if the default router as received any other traffic recently, it's MAC address is in the host ARP cache already -- no request will be sent. If this is the case, you will only see one unanswered ARP request.

Are any capture or read filters being used?

Can you capture on the device responding to the ping? If it is on the same LAN, do you see the incoming ARP request and the outgoing reply?

Richard J Moore wrote:



I have traced a successful ping. I see the ARP requests, but I never see
any responses. Why is this? My version of ethereal is 0.10.0a on RHEL3
Linux. (2.4.21-9.0.1-EL kernel).

Any insights would be appreciated.
- -
Richard J Moore
IBM Advanced Linux Response Team - Linux Technology Centre
MOBEX: 264807; Mobile (+44) (0)7739-875237
Office: (+44) (0)1962-817072

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users