Lab 11.9.1 Protocol Inspector and ARP

Estimated time: 20 min.

Objectives:

- Use Protocol Inspector (or equivalent) Software to study ARP requests and replies.

Background:

Protocol analysis software has a feature called capture. This feature allows all frames that travel through an interface to be captured for analysis. With this feature, you can peek in on the Address Resolution Protocol process. You may have found ARP a bit abstract, but with the protocol analyzer we can see just how important ARP is to the normal functioning of a network.

Tools / Preparation:

> Each PC must be running Windows 95, 98, or NT, Microsoft TCP/IP stack, and Winsock 2.0. Fluke Protocol Inspector 3.0 (or equivalent) must be installed on each PC. During the installation of the software you must specify which network adapter (NIC, dial-up, etc.) you wish to monitor – specify the NIC which attaches the PCs to an Ethernet. The PCs should be on either a 10BASE-T or 100BASE-TX Ethernet network which preferably includes servers, switches, routers, and printers and a connection to a web server, or preferably the Internet. (this will make the protocol analysis more interesting).

Worksheet

> 1. Open Protocol Inspector (or equivalent) software.
> 2. Go to detail view. What do you see?
> 3. Start a capture. What happens?
> 4. Open an MS-DOS window.
> 5. Using arp –a examine contents of ARP table. What do you see?
> 6. Using arp –d a.b.c.d delete all entries in ARP table. Use arp –a to re-examine the arp table. What has happened?
> 7. Using ping a.b.c.d to trigger an ARP frame. What happens? Ping your own machine or another machine on the network.
> 8. Stop the capture. What happens?
> 9. Study the ARP frames, ping frames, and statistics using various views, especially the detail view. Describe the various views and what you learned about ARP.
> 10. Start another capture to examine the network you are on.
> 11. Use the network for a minute or so (sending emails, request web pages, etc.) over some period of time (say 2 minutes) and see, in detail how many ARP frames occur. Are any occurring? If so, why?

Reflection:

> Why is ARP necessary for LANs to function?