https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15426
Bug ID: 15426
Summary: Add support for ARP Probe and ARP Announcement (RFC
5227)
Product: Wireshark
Version: 2.6.5
Hardware: x86-64
OS: Linux
Status: UNCONFIRMED
Severity: Enhancement
Priority: Low
Component: Dissection engine (libwireshark)
Assignee: bugzilla-ad...@wireshark.org
Reporter: tttta...@protonmail.com
Target Milestone: ---
Build Information:
Wireshark 2.6.5 (Git v2.6.5 packaged as 2.6.5-1)
Copyright 1998-2018 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.11.2, with libpcap, with POSIX capabilities
(Linux),
with libnl 3, with GLib 2.58.1, with zlib 1.2.11, with SMI 0.4.8, with c-ares
1.14.0, with Lua 5.2.4, with GnuTLS 3.5.19, with Gcrypt 1.8.4, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.35.0, with LZ4, with Snappy,
with libxml2 2.9.4, with QtMultimedia, with SBC, with SpanDSP, without bcg729.
Running on Linux 4.18.0-kali3-amd64, with Intel(R) Core(TM) i5-2500K CPU
@ 3.30GHz (with SSE4.2), with 7887 MB of physical memory, with locale
zh_CN.UTF-8, with libpcap version 1.8.1, with GnuTLS 3.5.19, with Gcrypt 1.8.4,
with zlib 1.2.11, binary plugins supported (0 loaded).
Built using gcc 8.2.0.
--
The IPv4 Address Conflict Detection method is described in RFC 5227, which uses
ARP Probe and ARP Announcement.
ARP Probe is a special broadcast ARP request. The sender IP address is all
zeros, the sender MAC address is the sender interface address, the target MAC
address is all zeros, and the target IP address is the probe IP address.
The ARP Probe is used to detect whether this IP address in the network has been
used by the host. The sender IP is all zeros to avoid polluting the ARP cache
table of other hosts. The target MAC address is all zeros and is ignored.
The ARP Probe is not parsed in the wireshark. It is only parsed into common ARP
packets.
When the host decides to use an IP address, it will broadcast ARP Announcement,
notify other hosts on the network, update the ARP cache of other hosts, and
ensure that there is no conflict.
ARP Announcement is actually Gratuitous ARP, the format is the same.
ARP Announcement is also a special ARP request. The sender MAC address is the
sender's interface address, the destination MAC address is all zeros, the
sender IP and the destination IP are the same, and both are set to the IP
address to be used.
"ARP Announcement" used in RFC 5527 is a more descriptive name for "Gratuitous
ARP"
I think the name "Gratuitous ARP" is outdated. The name "Gratuitous ARP" is
very unintuitive. If you don't read the relevant documents, you don't know what
it is.
"ARP Announcement" is a better name, you know what you are doing for the first
time you see it.
Would it be better to change the "Gratuitous ARP" in wireshark to the new name
"ARP Announcement"?
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
