RE: [Ethereal-users] ARP reply before the request

[Richard Urwin <rurwin@xxxxxxxxxxxxxxx>]

> This time, I've captured all the packets, but the ARP reply still comes 
> 0.3ms (this delay is very small!) before the request. Could this be a 
> problem of the data capture?

It is just possible that the different paths through the operating system
give you that sort of timeing error.

> And capturing all the packets, I've realized that in this LAN there are 
> a lot of ARP requests without reply. In fact, the only ARP replies I've 
> found in the network are the replies directed to my computer. (And I do 
> capture the packets in promiscuous mode)

But are you on a switching hub? (http://www.ethereal.com/faq.html#q4.1) I
strongly suspect that you are. Can you find an example of a packet with both
source and destination addresses which are not your machine and are not
"broadcast"?

> Besides that, the ARP requests that my computer produce have only 46 
> bytes and the other ARP requests have only 60 bytes, which is bellow 
> the Ethernet packet minimum length. And no packet has the Ethernet CRC.

This sounds like Capture->Start->CaptureLength is set to a low value. Set it
to 65535 unless you've got a good reason not to. Check: in the middle pane,
the first line contains the text "(x on wire, y captured)" x and y should be
the same number.


-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx

________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________