Pub Quiz Answer: ARP is Mean!

Register for VIP Notification of the next Packet Pub Quiz at https://coreitpros.com/quiz.


Good ol' ARP tripped up a lot of people during the last Packet Pub Quiz. In fact, only 28% of people selected the correct answer. Let's look at the question and go through the answer.


Which statement about this packet is correct?

a. This is an ARP request.

b. This packet cannot be routed.

c. This is a broadcast packet.

d. This packet was sent by 10.2.1.205.

In my Day 1 Workshop (CORE Packets and Protocols) at the CORE-IT Pros conference, we'll be deep-diving into lots of protocols. Join me! Register online at https://coreitpros.com.


CORRECT ANSWER REVIEW

This packet cannot be routed.

ARP packets are missing a vital element needed for routing - a routing header! Notice in the image above, the Ethernet Type field contains 0x0806 indicating that ARP is coming up next. If this packet had an IPv4 header (we don't use ARP in IPv6), we would have seen 0x0800 in the Ethernet Type field.


INCORRECT ANSWER REVIEW

This is an ARP request.

Nope. We can clearly see the Opcode field in the ARP section - Opcode: reply (2).


This is a broadcast packet.

Nope. In the Ethernet header, the destination address is 0x00:d0:59:aa:af:80. The broadcast address is 0xFF:FF:FF:FF:FF:FF.


This packet was sent by 10.2.1.205.

Nope. As seen in the ARP section, the Sender IP address field indicates that 10.2.1.1 sent this packet. The address 10.2.1.205 is the target.


Sign up for VIP Notification and Access to our Packet Pub Quizzes at https:/coreitpros.com.

16 views0 comments