netsh interface ipv4 show interfaces
Example result:
Idx Met MTU State Name
--- --- ----- ----------- -------------------
1 50 4294967295 connected Loopback Pseudo-Interface 1
9 20 1500 connected Local Area Connection
netsh interface ipv4 show interface 9
Example result:
Interface Local Area Connection Parameters
----------------------------------------------
IfLuid : ethernet_7
IfIndex : 9
Compartment Id : 1
State : connected
Metric : 20
Link MTU : 1500 bytes
Reachable Time : 19000 ms Base Reachable Time : 30000 ms Retransmission Interval : 1000 ms
DAD Transmits : 3 Site Prefix Length : 64 Site Id : 1 Forwarding : disabled
Advertising : disabled Neighbor Discovery : enabled Neighbor Unreachability
Detecion : enabled Router Discovery : dhcp Managed Address Configuration :
enabled Other Stateful Configuration : enabled Weak Host Sends : disabled Weak
Host Receives : disabled Use Automatic Metric : enabled Ignore Default routes :
disabled
Showing posts with label arp. Show all posts
Showing posts with label arp. Show all posts
Tuesday, September 7, 2010
Why is there no ARP reply in the packet trace
>Hello
> I'm having a situation concerning Arp where i am seeing no Arp
>reply's to many arp requests on my network when i evaluate with a
>protocol analyzer. I think the arp traffic may be at a level where it
>is disrupting traffic on the network and nodes are dropping off as a
>result. It is a microsoft 2000/xp network running active directory.
>The sniffs show alot of whois arp traffic and i see little or no arp
>reply's with the mac address. I'm wondering what this could be due
>too. It is a flat network with 175 nodes running a class b subnet.
>Wins and Dns are configured. The workstation nodes are mixed
>win2k/xp(majority being 2k), The servers are win2k. Is this high
>amount of arp traffic(between 60 to 90 percent at a server)normal and
>if not what could i do to facilitate the arp reply's. Thanks
How is your protocol analyzer connected to the network? If you're on a
switch, it would be logical that you don't see ARP reply's.
The ARP requests are in the fowm of a broadcast, so sent to every
port. However, the reply is sent as an unicast to the host which made
the ARP request.
Unless you configured a SPAN por, you won't see this traffic on a
switched network. This would also explain why you see such a high
percentage of ARP requests: the unicast traffic isn't captured by your
protocol analyzer.
With kind regards,
Patrick
> I'm having a situation concerning Arp where i am seeing no Arp
>reply's to many arp requests on my network when i evaluate with a
>protocol analyzer. I think the arp traffic may be at a level where it
>is disrupting traffic on the network and nodes are dropping off as a
>result. It is a microsoft 2000/xp network running active directory.
>The sniffs show alot of whois arp traffic and i see little or no arp
>reply's with the mac address. I'm wondering what this could be due
>too. It is a flat network with 175 nodes running a class b subnet.
>Wins and Dns are configured. The workstation nodes are mixed
>win2k/xp(majority being 2k), The servers are win2k. Is this high
>amount of arp traffic(between 60 to 90 percent at a server)normal and
>if not what could i do to facilitate the arp reply's. Thanks
How is your protocol analyzer connected to the network? If you're on a
switch, it would be logical that you don't see ARP reply's.
The ARP requests are in the fowm of a broadcast, so sent to every
port. However, the reply is sent as an unicast to the host which made
the ARP request.
Unless you configured a SPAN por, you won't see this traffic on a
switched network. This would also explain why you see such a high
percentage of ARP requests: the unicast traffic isn't captured by your
protocol analyzer.
With kind regards,
Patrick
The ARP Command -s
arp -s InetAddr EtherAddr
allows you to manually add an entry to the ARP cache that resolves the IP address InetAddr to the physical address EtherAddr.
Subscribe to:
Posts (Atom)