1. ARP Under Normal Conditions

2. The basics arp with reverse DNS lookup for each IP arp –a # Windows & linux Without reverse DNS lookup (runs faster) arp –n # Linux only Google to find the 224.* enties Who made the NIC for your host machine? your VM workstation? the 224.* entries?

3. See an entry get added: New machines are added to the ARP table when you communicate with them: arp –n ping 10.10.1.5 wget 10.10.1.10 arp -n

4. Delete an entry: arp –n ping 10.10.1.10 sudo arp –d 10.10.1.10 arp –n Note that deleting an entry does not remove it entirely – just the MAC address The complete entry will be deleted when it times out

5. Delete all entries: ping 10.10.1.5 ping 10.10.1.10 arp –n sudo ip neigh flush all arp –n It would be nice to be able to do this with arp instead of using a separate tool

6. Add an entry manually: Find the MAC of your webserver. Use it in place of the MAC address below: arp –n sudo arp –s 10.10.1.10 00:50:56:83:09:4e arp –n Find out what the “CM” means man arp /flag n # press for Next match

7. Delete a manual entry: Try a flush: arp –n sudo ip neigh flush all arp –n Try a manual delete: arp –n sudo arp –d 10.10.1.10 arp –n

8. How long do entries stay in the ARP cache? Timeout is stored in a file. The value is in seconds. cat /proc/sys/net/ipv4/neigh/eth0/gc_stale_time sudo nano # Change value to 600 and save ping 10.10.1.10 arp –n #Wait for > 60 seconds arp –n #The entry should still be in the cache # Change it back to 60

9. Map a complete arp request: In window A: sudo tcpdump –n –e –i eth0 not host 10.10.1.5 In window B: arp –n ping –c 1 10.10.1.10 Wait for 6 messages to be received, then stop tcpdump

10. Map a complete arp request: IP: MAC: IP: MAC: Create a diagram like this on a piece of paper. Map all 6 messages, showing the direction they were sent, along with a short description of the payload bcast to ff:ff:ff:ff:ff:ff, ARP request. Who has 10.10.1.10, tell 10.10.1.100

11. Map a complete arp request: Answer from exercise: 1. ARP request MAC-A to broadcast ff.ff.ff.ff.ff.ff:Who has 10.10.1.10, tell 10.10.1.100 2. ARP reply MAC-B to MAC-A: 10.10.1.10 is at MAC-B 3. ICMP echo request (ping) A to B 4. ICMP echo reply (ping) B to A 5. ARP request MAC-B to MAC-A: Who has 10.10.1.100, tell 10.10.1.10 6. ARP reply MAC-A to MAC-B: 10.10.1.100 is at MAC-A AB 1 2 3 4 5 6 Note that the second ARP request does not use the broadcast address. This seems to be verifying the data that B pulled off the original request.