> This time, I've captured all the packets, but the ARP reply still comes
> 0.3ms (this delay is very small!) before the request. Could this be a
> problem of the data capture?
It is just possible that the different paths through the operating system
give you that sort of timeing error.
> And capturing all the packets, I've realized that in this LAN there are
> a lot of ARP requests without reply. In fact, the only ARP replies I've
> found in the network are the replies directed to my computer. (And I do
> capture the packets in promiscuous mode)
But are you on a switching hub? (http://www.ethereal.com/faq.html#q4.1) I
strongly suspect that you are. Can you find an example of a packet with both
source and destination addresses which are not your machine and are not
"broadcast"?
> Besides that, the ARP requests that my computer produce have only 46
> bytes and the other ARP requests have only 60 bytes, which is bellow
> the Ethernet packet minimum length. And no packet has the Ethernet CRC.
This sounds like Capture->Start->CaptureLength is set to a low value. Set it
to 65535 unless you've got a good reason not to. Check: in the middle pane,
the first line contains the text "(x on wire, y captured)" x and y should be
the same number.
--
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx
________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________
