Wireshark: Analyzing ARP Traffic

1. Generating and Capturing ARP Traffic

To see an ARP exchange, we first need to cause one to happen. As you learned, your computer stores known IP-to-MAC mappings in an ARP cache to avoid sending requests every time. To guarantee we see a new request, we will first clear this cache and then try to contact another device on the local network, forcing your computer to use ARP to find its MAC address.

The video below gives a fantastic, quick overview of this entire process. You'll see how to start a Wireshark capture, generate traffic using ping, and identify the resulting ARP request and reply.

2. Hands-On: Capturing Your Own ARP Packets

Now it's your turn. Follow these steps to capture an ARP exchange between your computer and your default gateway (your home router).

Step 1: Find your Default Gateway's IP Address

You'll need this address to ping. Open a command prompt (on Windows) or terminal (on macOS/Linux) and use the netstat -r command. Look for the "Gateway" address associated with the destination 0.0.0.0 or default.

Step 2: Clear Your ARP Cache

This forces your computer to issue a new ARP request. The command varies by OS:

• Windows: arp -d * (You may need to run Command Prompt as an administrator).
• macOS: sudo arp -d -a
• Linux: sudo ip -s -s neigh flush all

You can view the cache before and after clearing it with arp -a.

Step 3: Start Capturing with Wireshark

1. Open Wireshark.
2. You'll see a list of network interfaces (e.g., "Wi-Fi," "Ethernet"). Double-click the one you are currently using to access the internet.
3. In the "display filter" bar at the top, type arp and press Enter. This will hide all other traffic and only show us ARP packets.

Step 4: Generate the Traffic

Go back to your terminal and ping your default gateway's IP address once:
ping <gateway_ip_address> (e.g., ping 192.168.1.1)

Step 5: Analyze the Capture

You should see at least two packets appear in Wireshark: an ARP request and an ARP reply. You can now stop the capture by clicking the red square button.

3. Analyzing the ARP Request

Let's dissect the first packet, the ARP request. In the Wireshark "Packet List" pane, this packet will have an "Info" line similar to: Who has <gateway_ip>? Tell <your_ip>. Click on it.

Now look at the "Packet Details" pane below it. Expand the "Ethernet II" and "Address Resolution Protocol (request)" sections.

This next video provides a very detailed, field-by-field breakdown of what you're looking at. Use it to guide your analysis of your own captured packet.

Here's a summary of what to look for in your ARP request:

• Ethernet II Header:
  • Destination: Broadcast (ff:ff:ff:ff:ff:ff). This confirms the request was sent to every device on the local network.
  • Source: Your computer's MAC address.
  • Type: ARP (0x0806). This value tells the receiving network card to pass the frame's payload to the ARP process.
• Address Resolution Protocol (request) section:
  • Opcode: request (1). This identifies the packet as a request.
  • Sender MAC address: Your computer's MAC address.
  • Sender IP address: Your computer's IP address.
  • Target MAC address: 00:00:00:00:00:00. This is the "question" part of the request—the address is unknown.
  • Target IP address: Your default gateway's IP address.

4. Analyzing the ARP Reply

Now, select the second packet in your Wireshark capture, the ARP reply. The "Info" line will look something like: <gateway_ip> is at <gateway_mac>.

Let's continue with the video to analyze the reply.

Here is a summary for your ARP reply:

• Ethernet II Header:
  • Destination: Your computer's MAC address. This confirms the reply was sent directly to you (unicast), not broadcast.
  • Source: Your gateway's MAC address.
• Address Resolution Protocol (reply) section:
  • Opcode: reply (2).
  • Sender MAC address: Your gateway's MAC address. This is the "answer" you were looking for!
  • Sender IP address: Your gateway's IP address.
  • Target MAC address: Your computer's MAC address.
  • Target IP address: Your computer's IP address.

This screenshot shows a clear example of what an analyzed ARP reply looks like in Wireshark.

5. Closing the Loop: The ARP Cache

Finally, go back to your terminal one last time and run arp -a. You should now see an entry for your default gateway, listing its IP address and the MAC address that was just learned via the ARP reply you analyzed. Your computer has cached this information for future use.

Conclusion

Congratulations! You have successfully captured, dissected, and understood a live ARP conversation on your network. This is a critical skill for any networking enthusiast or professional, as it demystifies how devices on a local network find each other.

Key Takeaways:

• Wireshark is a tool that allows you to see the raw data frames being sent and received by your computer.
• An ARP request uses a broadcast Ethernet destination address (ff:ff:ff:ff:ff:ff) to reach all devices on the LAN.
• An ARP reply uses a unicast Ethernet destination address, sending the answer directly to the original requester.
• The ARP packet fields (Opcode, Sender/Target addresses) contain all the information needed for the request-and-reply process.
• The arp -a command allows you to see the IP-to-MAC mappings that your computer has learned and stored.

Preview of the Next Lesson:

In this lesson, we used the ping command simply to generate traffic. But what is ping actually doing? It's not just a tool for forcing ARP requests; it's a powerful diagnostic utility in its own right that uses another core protocol: ICMP (Internet Control Message Protocol). In the next lesson, we will dive into ICMP, explore how ping works to test network connectivity and measure latency, and analyze ICMP packets in Wireshark.