0

ARP: can't see broadcast packets

ARP

asked 2023-02-27 22:21:35 +0000

zer0uno
1 ●1

updated 2023-02-27 23:05:21 +0000

System configurations:

Wireshark 3.2.3
Ubuntu 20.04
Wireless card in promiscuous mode

When I try to capture ARP packets I can notice two strange things:

In the packets panel the ARP destination always contains my MAC address and not the word "Broadcast" even if within the packet the destination address is 00:00:00:00:00:00.
I never see in the packets panel broadcast packets for IP addresses different than mine. In other words I can only see ARP request packet "Who has X?" where X is always my IP address (of course I can see my ARP replies)

edit retag flag offensive close merge delete

Comments

Perhaps 00:00;00:00:00:00 matches your machine due to a config file containing the match. A sample file would go a long way.

hugo.vanderkooij ( 2023-02-28 13:19:08 +0000 )edit

1 Answer

Sort by » oldest newest most voted

0

answered 2023-02-28 16:37:31 +0000

Bob Jones
1481 ●2 ●171 ●22 Boston, MA

Does your wireless infrastructure have multicast-to-unicast or some such feature turned on? If enabled, this usually applies to all group traffic, which would be multicast and broadcast. So broadcast would be sent directly to your host via the 802.11 unicast mechanism, which has your MAC address as the destination at Layer2. You might not see other hosts ARP because some wifi systems learn MAC and IP addresses of clients, and will then filter appropriately.

edit flag offensive delete link

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Question Tools

1 follower

Stats

Asked: 2023-02-27 22:21:35 +0000

Seen: 340 times

Last updated: Feb 28 '23

Related questions

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

Powered by Askbot version 0.10.2