Pub Quiz Answer: ARP is Mean!

Register for VIP Notification of the next Packet Pub Quiz at

Good ol' ARP tripped up a lot of people during the last Packet Pub Quiz. In fact, only 28% of people selected the correct answer. Let's look at the question and go through the answer.

Which statement about this packet is correct?

a. This is an ARP request.

b. This packet cannot be routed.

c. This is a broadcast packet.

d. This packet was sent by

In my Day 1 Workshop (CORE Packets and Protocols) at the CORE-IT Pros conference, we'll be deep-diving into lots of protocols. Join me! Register online at


This packet cannot be routed.

ARP packets are missing a vital element needed for routing - a routing header! Notice in the image above, the Ethernet Type field contains 0x0806 indicating that ARP is coming up next. If this packet had an IPv4 header (we don't use ARP in IPv6), we would have seen 0x0800 in the Ethernet Type field.


This is an ARP request.

Nope. We can clearly see the Opcode field in the ARP section - Opcode: reply (2).

This is a broadcast packet.

Nope. In the Ethernet header, the destination address is 0x00:d0:59:aa:af:80. The broadcast address is 0xFF:FF:FF:FF:FF:FF.

This packet was sent by

Nope. As seen in the ARP section, the Sender IP address field indicates that sent this packet. The address is the target.

Sign up for VIP Notification and Access to our Packet Pub Quizzes at https:/

16 views0 comments