Thank you for your attention, but it seems that this is not the problem.
This time, I've captured all the packets, but the ARP reply still comes
0.3ms (this delay is very small!) before the request. Could this be a
problem of the data capture?
And capturing all the packets, I've realized that in this LAN there are
a lot of ARP requests without reply. In fact, the only ARP replies I've
found in the network are the replies directed to my computer. (And I do
capture the packets in promiscuous mode)
Besides that, the ARP requests that my computer produce have only 46
bytes and the other ARP requests have only 60 bytes, which is bellow
the Ethernet packet minimum length. And no packet has the Ethernet CRC.
This is very different from what I've studied. I'm really puzzled. Does
someone know what's happening? Could this be a problem of the data
capture?
Thanks
> -----Original Message-----
> From: rurwin [mailto:rurwin@xxxxxxxxxxxxxxx]
> Sent: Wednesday, April 03, 2002 10:32 AM
> To: ethereal-users
> Cc: rurwin
> Subject: RE: [Ethereal-users] ARP reply before the request
>
>
> That filter will not show you ARP requests from any other
> machines. Maybe
> someone else sent an ARP request before the one you are interested in?
>
> I find display filters easier to use than capture filters, and you can
> always go back to the full data if you get confused.
>
> --
> Richard Urwin, Software Design Engineer
> Schenck Test Automation
> Braemar Court, 1311b Melton Road, Syston, UK.
> rurwin@xxxxxxxxxxxxx
>
>
>
> -----Original Message-----
> From: akira.nakandakare@xxxxxxxxxxxxx
> [mailto:akira.nakandakare@xxxxxxxxxxxxx]
> Sent: Wednesday, April 03, 2002 9:01 AM
> To: ethereal-users@xxxxxxxxxxxx
> Subject: [Ethereal-users] ARP reply before the request
>
>
> Hello!
>
> I'm a new user of Ethereal (and new in this mailing list too) and I'm
> using it to analyse some LAN protocols in order to develop a small
> embedded webserver connected to an Ethernet network.
>
> But when I was verifying some ARP requests, Ethereal has
> shown me that
> there were ARP replies before the ARP requests. Does anyone
> know how I
> got this?
>
> I'm using the following filter during the capture:
>
> host 172.29.228.2 or ether host 42:41:42:41:43:41 or host c51uweb
>
> Thanks in advance.
>
> --
> Cleber Akira NAKANDAKARE
> Application Lab.
> Atmel Nantes SA
