On Tue, Jul 01, 2003 at 04:33:57PM +0100, Daniel Frimerman wrote: > Thing is, I just used raw sockets to send tcp packets to a big list of IP > addresses. When I sniffed (Ethereal) the network I saw a few ARP packets > coming in and out, but that's nothing compared to how many packets I've sent > out. > > So what does Windows do to send it out? I use Cable, maybe it sends it to > the mac address of the router on the ISP?
If the first hop on the path of an IP packet to its destination is on a broadcast LAN (Ethernet, FDDI, Token Ring, IEEE 802.11, etc.), the MAC address on the packet, on that first hop, is probably to the destination machine if it's on the same LAN segment or to a router on that LAN segment if the destination machine isn't on the same LAN segment. Windows - and most if not all other OSes - get that address by sending out an ARP packet *if* it doesn't already have the MAC address, and uses the address it has if it does already have it. (I.e., you should *not* assume the number of ARP packets will necessarily be equal to the number of packets you've sent.) If the machines aren't all on your LAN segment, and the same router is used to route all of them to their destinations, only one ARP will be needed - the one to get the MAC address of the router. ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
