ARP Under Normal Conditions

The basics arp with reverse DNS lookup for each IP arp –a # Windows & linux Without reverse DNS lookup (runs faster) arp –n # Linux only Google to find the 224.* enties Who made the NIC for your host machine? your VM workstation? the 224.* entries?

See an entry get added: New machines are added to the ARP table when you communicate with them: arp –n ping wget arp -n

Delete an entry: arp –n ping sudo arp –d arp –n Note that deleting an entry does not remove it entirely – just the MAC address The complete entry will be deleted when it times out

Delete all entries: ping ping arp –n sudo ip neigh flush all arp –n It would be nice to be able to do this with arp instead of using a separate tool

Add an entry manually: Find the MAC of your webserver. Use it in place of the MAC address below: arp –n sudo arp –s :50:56:83:09:4e arp –n Find out what the “CM” means man arp /flag n # press for Next match

Delete a manual entry: Try a flush: arp –n sudo ip neigh flush all arp –n Try a manual delete: arp –n sudo arp –d arp –n

How long do entries stay in the ARP cache? Timeout is stored in a file. The value is in seconds. cat /proc/sys/net/ipv4/neigh/eth0/gc_stale_time sudo nano # Change value to 600 and save ping arp –n #Wait for > 60 seconds arp –n #The entry should still be in the cache # Change it back to 60

Map a complete arp request: In window A: sudo tcpdump –n –e –i eth0 not host In window B: arp –n ping –c Wait for 6 messages to be received, then stop tcpdump

Map a complete arp request: IP: MAC: IP: MAC: Create a diagram like this on a piece of paper. Map all 6 messages, showing the direction they were sent, along with a short description of the payload bcast to ff:ff:ff:ff:ff:ff, ARP request. Who has , tell

Map a complete arp request: Answer from exercise: 1. ARP request MAC-A to broadcast ff.ff.ff.ff.ff.ff:Who has , tell ARP reply MAC-B to MAC-A: is at MAC-B 3. ICMP echo request (ping) A to B 4. ICMP echo reply (ping) B to A 5. ARP request MAC-B to MAC-A: Who has , tell ARP reply MAC-A to MAC-B: is at MAC-A AB Note that the second ARP request does not use the broadcast address. This seems to be verifying the data that B pulled off the original request.