VK:
Okay, bad form: replying to my own email twice in
a row. Ray (an echoWare developer who's on the Kaboodle list)
pointed out to me a potential problem with what I wrote:
just because a device broadcast ARP's a who-has with its
own IP address (eg, 0:60:b0:73:63:a4 ff:ff:ff:ff:ff:ff 0806
60: arp who-has 192.168.123.10 tell 192.168.123.10) doesn't
meant that that device is going to *get* that IP address.
That is, in the above, 0:60:b0:73:63:a4 may or may not
become 192.168.123.10.
So let's do it this way:
1. Any ARP messages with "ff:ff:ff:ff:ff:ff" as the destination
address should be sniffed.
2. If the packet has the Kaboodle PC's IP address at the
end (ie, after "tell"), it can be ignored.
3. Kaboodle should then look at the IP address being asked
about. So in "who-has a.b.c.d", Kaboodle should care most
about a.b.c.d.
4. If a.b.c.d is not already in the "Active Device List",
then Kaboodle should ping that IP address.
5. If there's a response from that ping, Kaboodle should add
that IP address, plus the MAC address from the OS's
ARP cache, to the "Active Device List".
So...how close is this to what is actually implemented
in the current code? I've not yet seen any documentation about
what's in there, and I couldn't tell from the comments in the
source.
-Scott
On Wed, 10 Jul 2002, Scott C. Best wrote:
> VK:
> Just to elaborate: on my unix box I'm running tcpdump:
>
> /usr/sbin/tcpdump -n -s 1024 -i eth0 -e src 192.168.123.10
>
> I then turn on my printer (which I know is going to
> come up with the IP address 192.168.123.10 and a gateway IP
> of 192.168.123.123). Results:
>
> tcpdump: listening on eth0
> 22:04:16.627612 0:60:b0:73:63:a4 ff:ff:ff:ff:ff:ff 0806 60: arp who-has
> 192.168.123.10 tell 192.168.123.10
> 22:04:16.630692 0:60:b0:73:63:a4 ff:ff:ff:ff:ff:ff 0806 60: arp who-has
> 192.168.123.123 tell 192.168.123.10
>
> This is within seconds of the printer turning on. So
> the printer does two things: it sends a broadcast ARP's looking
> to see if any devices have its intended IP address, and it
> sends a broadcast looking for its gateway.
>
> Kaboodle's sniffer thread should be able to detect
> this. Any "ARP who-has" broadcasts to "ff:ff:ff:ff:ff:ff"
> should be sniffed. The first field after the timestamp is
> the MAC address of a device that should be associated with
> the IP address in the last field.
>
> -Scott
>
> On Wed, 10 Jul 2002, S.C.Best wrote:
>
> > VK:
> > Heya. Quick bug report: I startup Kaboodle (with a
> > fresh registry) with my LAN printer turned off. After the GUI
> > is built, I turn on the printer.
> > I notice about a minute delay between the time that
> > the printer broadcasts its "arp who-has" message and the time
> > that Kaboodle's GUI updates. It should be must faster than that,
> > unless it's not sniffing for the right pattern.
> >
> > -Scott
> >
> >
> >
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by:ThinkGeek
> > Two, two, TWO treats in one.
> > http://thinkgeek.com/sf
> > _______________________________________________
> > Kaboodle-devel mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/kaboodle-devel
> >
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Two, two, TWO treats in one.
> http://thinkgeek.com/sf
> _______________________________________________
> Kaboodle-devel mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/kaboodle-devel
>
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Two, two, TWO treats in one.
http://thinkgeek.com/sf
_______________________________________________
Kaboodle-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/kaboodle-devel
