Perhaps there is some confusion about the term 'Target ARP'. In an ARP packet, the destination MAC address in the ethernet header is all Fs. The Target Hardware Address is all zeroes. Take a look:
Ethernet Header -------------------------- Destination: FF:FF:FF:FF:FF:FF Ethernet Broadcast Source: 00:04:AC:4C:5D:F3 Protocol Type: 0x0806 IP ARP ARP - Address Resolution Protocol -------------------------------------------------------- Hardware: 1 Ethernet (10Mb) Protocol: 0x0800 IP Hardware Address Length: 6 Protocol Address Length: 4 Operation: 1 ARP Request Sender Hardware Address: 00:04:AC:4C:5D:F3 Sender Internet Address: 10.1.103.20 Target Hardware Address: 00:00:00:00:00:00 (ignored) Target Internet Address: 10.1.103.52 On a related note, I just discovered that it is a major pain to copy a packet capture from Etherpeek!! If any of you know how to copy an entire packet as text, please let me know. :-) John >>> "Priscilla Oppenheimer" 2/15/02 11:13:41 AM >>> I assume you read it wrong. It's a packet captured from a network, unedited. At 09:05 PM 2/14/02, Andy Barkl wrote: >Priscilla, first of all thank you for the use of your CIT flash cards. >Secondly, in the following question, >http://www.priscilla.com/cit/general/answer14.html it indicates that a >target ARP address is all 0s. This was confusing when I saw it because >my understanding is that a target ARP is all Fs. >Can you clarify this? I assume it's simply a typo. > >Thank you. > > > >-----Original Message----- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of >Priscilla Oppenheimer >Sent: Thursday, February 14, 2002 4:08 PM >To: [EMAIL PROTECTED] >Subject: Re: Off topic but somehow interesting problem [7:35426] > >At 03:39 PM 2/14/02, Patrick Ramsey wrote: > >arp is an ethernet protocol...not in the ip stack per se... (even >though I > >think Microsoft install arp with it's ip stack) > >ARP is defined in RFC 826. In other words, it's defined by the same >standards body that defines IP protocols. ARP is used to map IP >addresses >to data-link-layer addresses. It's an essential component of an IP >implementation. But let's not get into one of those arguments again. ;-) > >The original poster says that the sender is setting its own >data-link-layer >address to FF FF FF FF FF FF. This would indicate a major bug in the >driver. > >It makes one wonder if the poster is misinterpreting the protocol >analyzer >output? Can you send it to us?? Sorry, if this assumption is wrong but >the >error that you report is so bizarre, we have to wonder..... > >Priscilla ________________________ Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=35525&t=35426 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
