Ask Your Question
0

ARP: can't see broadcast packets

asked 2023-02-27 22:21:35 +0000

zer0uno gravatar image

updated 2023-02-27 23:05:21 +0000

System configurations:

  • Wireshark 3.2.3
  • Ubuntu 20.04
  • Wireless card in promiscuous mode

When I try to capture ARP packets I can notice two strange things:

  1. In the packets panel the ARP destination always contains my MAC address and not the word "Broadcast" even if within the packet the destination address is 00:00:00:00:00:00.
  2. I never see in the packets panel broadcast packets for IP addresses different than mine. In other words I can only see ARP request packet "Who has X?" where X is always my IP address (of course I can see my ARP replies)
edit retag flag offensive close merge delete

Comments

Perhaps 00:00;00:00:00:00 matches your machine due to a config file containing the match. A sample file would go a long way.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2023-02-28 13:19:08 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-02-28 16:37:31 +0000

Bob Jones gravatar image

Does your wireless infrastructure have multicast-to-unicast or some such feature turned on? If enabled, this usually applies to all group traffic, which would be multicast and broadcast. So broadcast would be sent directly to your host via the 802.11 unicast mechanism, which has your MAC address as the destination at Layer2. You might not see other hosts ARP because some wifi systems learn MAC and IP addresses of clients, and will then filter appropriately.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-02-27 22:21:35 +0000

Seen: 549 times

Last updated: Feb 28 '23