Trama de ARP Request: (tlm26 tlm34)
ff ff ff ff ff ff 0 10 4b 95 ce a7 8 6 0 1 8 0 6 4 0 1 0 10 4b 95 ce a7 1 1 1 1a 0 0 0 0 0 0 1 1 1 22 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Nivel: Ethernet Direccion MAC origen (48) = 0:10:4b:95:ce:a7 (0x00104b95cea7) Direccion MAC destino (48) = ff:ff:ff:ff:ff:ff (0xffffffffffff) Tipo (16) = Ethernet II + ARP (IP, CHAOSnet) (2054 dez.) (0x0806) Bytes de datos = 46 Nivel: ARP Tam: 28 Hardware Type (16) = Ethernet 10 Mbps (0x0001) Protocol Type (16) = IP DoD (2048 dez.) (0x0800) Hardware Length (8) = 6 (0x06) Software Length (8) = 4 (0x04) Operation Code (16) = ARP Request (0x0001) Hardware sourde address (48) = 0:10:4b:95:ce:a7 (0x00104b95cea7) Software source address (32) = 1.1.1.26 (0x0101011a) Hardware destination address (48) = 0:0:0:0:0:0 (0x000000000000) Software destination address (32) = 1.1.1.34 (0x01010122) Bytes de datos = 0
Trama de ARP Reply:
0 10 4b 95 ce a7 0 10 4b 99 9d 17 8 6 0 1 8 0 6 4 0 2 0 10 4b 99 9d 17 1 1 1 22 0 10 4b 95 ce a7 1 1 1 1a 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Nivel: Ethernet Direccion MAC origen (48) = 0:10:4b:99:9d:17 (0x00104b999d17) Direccion MAC destino (48) = 0:10:4b:95:ce:a7 (0x00104b95cea7) Tipo (16) = Ethernet II + ARP (IP, CHAOSnet) (2054 dez.) (0x0806) Bytes de datos = 46 Nivel: ARP Tam: 28 Hardware Type (16) = Ethernet 10 Mbps (0x0001) Protocol Type (16) = IP DoD (2048 dez.) (0x0800) Hardware Length (8) = 6 (0x06) Software Length (8) = 4 (0x04) Operation Code (16) = ARP Reply (0x0002) Hardware sourde address (48) = 0:10:4b:99:9d:17 (0x00104b999d17) Software source address (32) = 1.1.1.34 (0x01010122) Hardware destination address (48) = 0:10:4b:95:ce:a7 (0x00104b95cea7) Software destination address (32) = 1.1.1.26 (0x0101011a) Bytes de datos = 0
Ejemplo con tcpdump: (tlm26 tlm34)
[root@tlm15 /root]# tcpdump arp Kernel filter, protocol ALL, datagram packet socket tcpdump: listening on all devices 21:04:17.441761 eth0 B arp who-has tlm34.net.tlm.unavarra.es tell tlm26.net.tlm.unavarra.es 21:04:17.441809 eth0 P arp reply tlm34.net.tlm.unavarra.es is-at 0:10:4b:99:9d:17 (0:10:4b:95:ce:a7)