Pinging 10.0.0.6 from 10.0.0.10, I get the following while snooping [in another shell]:
<tcpdump> would normally report something like
I don't understand why, with <snoop>, in each of the above ARP's both IP addresses are the same.
Any explanation?
Code:
IRIS 1 # snoop -r -V arp,icmp
Using device ef0 (promiscuous mode)
________________________________
10.0.0.10 -> (broadcast) ETHER Type=0806 (ARP), size = 42 bytes
10.0.0.10 -> (broadcast) ARP C Who is 10.0.0.6, 10.0.0.6 ?
________________________________
10.0.0.6 -> 10.0.0.10 ETHER Type=0806 (ARP), size = 60 bytes
10.0.0.6 -> 10.0.0.10 ARP R 10.0.0.6, 10.0.0.6 is <ethernet address deleted>
________________________________
10.0.0.10 -> 10.0.0.6 ETHER Type=0800 (IP), size = 98 bytes
10.0.0.10 -> 10.0.0.6 IP D=10.0.0.6 S=10.0.0.10 LEN=84, ID=49286
10.0.0.10 -> 10.0.0.6 ICMP Echo request (ID: 37789 Sequence number: 0)
________________________________
10.0.0.6 -> 10.0.0.10 ETHER Type=0800 (IP), size = 98 bytes
10.0.0.6 -> 10.0.0.10 IP D=10.0.0.10 S=10.0.0.6 LEN=84, ID=6484
10.0.0.6 -> 10.0.0.10 ICMP Echo reply (ID: 37789 Sequence number: 0)
Using device ef0 (promiscuous mode)
________________________________
10.0.0.10 -> (broadcast) ETHER Type=0806 (ARP), size = 42 bytes
10.0.0.10 -> (broadcast) ARP C Who is 10.0.0.6, 10.0.0.6 ?
________________________________
10.0.0.6 -> 10.0.0.10 ETHER Type=0806 (ARP), size = 60 bytes
10.0.0.6 -> 10.0.0.10 ARP R 10.0.0.6, 10.0.0.6 is <ethernet address deleted>
________________________________
10.0.0.10 -> 10.0.0.6 ETHER Type=0800 (IP), size = 98 bytes
10.0.0.10 -> 10.0.0.6 IP D=10.0.0.6 S=10.0.0.10 LEN=84, ID=49286
10.0.0.10 -> 10.0.0.6 ICMP Echo request (ID: 37789 Sequence number: 0)
________________________________
10.0.0.6 -> 10.0.0.10 ETHER Type=0800 (IP), size = 98 bytes
10.0.0.6 -> 10.0.0.10 IP D=10.0.0.10 S=10.0.0.6 LEN=84, ID=6484
10.0.0.6 -> 10.0.0.10 ICMP Echo reply (ID: 37789 Sequence number: 0)
<tcpdump> would normally report something like
Code:
arp who-has 10.0.0.6 tell 10.0.0.10
arp reply 10.0.0.6 is-at <ethernet address>
arp reply 10.0.0.6 is-at <ethernet address>
I don't understand why, with <snoop>, in each of the above ARP's both IP addresses are the same.
Any explanation?
_________________
To a first approximation all species are insects .