When the requester does already know the mapping, it will send a unicast ARP packet to the already known mac-adress to verify if that mac-address is still using the requested IP address. When the mapping is unknown, you will see an ARP packet sent to the broadcast mac-address ff:ff:ff:ff:ff:ff. as I said, I'm new to WireShark and don't have a deep understanding of networking yet (but trying to learn).Īn ARP request packet is used to map an IP address (Layer 3) to Mac address (Layer 2). Is the router ARP-ing the modem itself for some reason and the model does not respond? I may be just talking gibberish right now. Such behavior of the router is obviously not normal. I can account for everything when I access the router and check everything that is connected - nothing but the whitelisted devices that I configured myself. I have strict access controls, so there are no unauthorized devices. My set up is very simple: a router with Wi-Fi capabilities with two Ethernet connections + whoever is connected to Wi-Fi at the time (my phone, my wife's phone, my daughter's laptop and phone). I read an answer to a similar question, but it didn't make sense to me. I'm seeing my router continually ARP-ing an IP address that appears to be the same as my public address except for the last octet (after the last period). I'm new to Wireshark, so this may be a stupid question.
0 Comments
Leave a Reply. |