Packt+ | Advance your knowledge in tech

You're reading from Network Analysis using Wireshark 2 Cookbook Practical recipes to analyze and secure your network using Wireshark 2

Product type Paperback

Published in Mar 2018

Publisher

ISBN-13 9781786461674

Length 626 pages

Edition 2nd Edition

Tools

Wireshark

Concepts

Network Security

Authors (3):

Nagendra Kumar Nainar

Yoram Orzach

Yogesh Ramdoss

View More author details

Table of Contents (25) Chapters

Title Page

Dedication

Packt Upsell

Contributors

Preface

1. Introduction to Wireshark Version 2 FREE CHAPTER

2. Mastering Wireshark for Network Troubleshooting

3. Using Capture Filters

4. Using Display Filters

5. Using Basic Statistics Tools

6. Using Advanced Statistics Tools

7. Using the Expert System

8. Ethernet and LAN Switching

9. Wireless LAN

10. Network Layer Protocols and Operations

11. Transport Layer Protocol Analysis

12. FTP, HTTP/1, and HTTP/2

13. DNS Protocol Analysis

14. Analyzing Mail Protocols

15. NetBIOS and SMB Protocol Analysis

16. Analyzing Enterprise Applications' Behavior

17. Troubleshooting SIP, Multimedia, and IP Telephony

18. Troubleshooting Bandwidth and Delay Issues

19. Security and Network Forensics

Index

IPv4 address resolution protocol operation and troubleshooting

Ethernet is the popular and predominantly deployed Local Area Network (LAN) technology, spanning a transmission speed rate of 10 Mbps to 400 Gbps. This data link layer protocol uses a 48-bit MAC address as a data link layer identifier. In this recipe, we will discuss the IPv4 ARP and its related issues.

Getting ready

In the bottom-up troubleshooting approach, the first step for any connectivity issue is to ensure that the ARP resolution is successful for the respective IP address.

How to do it...

Consider the following screenshot of LAN topology:

LAN topology

In the preceding scenario, assume PC1 is trying to reach PC2:

Trigger ping probes from PC1 (10.1.1.101) to PC2 (10.1.1.102). This will trigger an ARP request from PC1 to PC2.
Check the ARP table on PC1 using arp-a, to see whether the MAC address for 10.1.1.102 is populated in the local table.
If you see the MAC address for 10.1.1.102 in the PC1 local table, that confirms that PC1...