[c-nsp] ARP requests

Gert Doering gert at greenie.muc.de
Wed Aug 19 14:06:56 EDT 2020


On Thu, Aug 20, 2020 at 12:05:07AM +0700, Eugene Grosbein wrote:
> > Otherwise, ask the router - "debug arp" - and for each ARP request you
> > see it issue, check the routing whether it points directly to an 
> > interface.
> Well, I have packet capture in my analyzer and I see all the details there,
> like this:

This is missing the point.  The router will tell you more on "what it
thinks the interface is".

> > (And never believe what switches say about tagging vs. not)
> I've saved capture to PCAP file and verified it with Wireshark, no tags.
> Still cannot understand why no tags.

On many platforms, monitoring ports will not show the original tag.

(On Cat6500, tags will only be shown if the *destination* port is set
to "switchport mode trunk", for example)

"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert at greenie.muc.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 630 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20200819/3bb30d8f/attachment.sig>

More information about the cisco-nsp mailing list