标签：arp
#免费ARP解析
R1(config)#int e1/1
R1(config-if)#ip addr 192.168.1.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#end
Frame 8: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) #全球标识
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast) # IG位判断是否接收，IG=1bit 为组播/广播；广播则接收，单播比较源mac
Source: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast) # IG=0bit 为单播
Type: ARP (0x0806) # ARP协议接收数据包
Padding: 000000000000000000000000000000000000
Address Resolution Protocol (reply/gratuitous ARP) # ARP协议 处理数据包
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
[Is gratuitous: True] # Is gratuitous: True 为免费ARP
Sender MAC address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Sender IP address: 192.168.1.1
Target MAC address: Broadcast (ff:ff:ff:ff:ff:ff)
Target IP address: 192.168.1.1 #免费ARP的报文发，用于查找自己的IP地址，只希望是起宣告作用；如果收到回应，则证明对方也使用自 #己目前使用的IP地址。
# ping命令解析
R1#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
.!!!!
R1#sh ip route 192.168.1.2 #第一步：查路由表，判断是否有路由，有路由则转发，否则丢弃
Routing entry for 192.168.1.0/24
Known via "connected", distance 0, metric 0 (connected, via interface) #存在路由，为直连路由
Routing Descriptor Blocks:
* directly connected, via Ethernet1/1
Route metric is 0, traffic share count is 1
R1#sh int e1/1
Ethernet1/1 is up, line protocol is up
Hardware is AmdP2, address is aabb.cc00.0511 (bia aabb.cc00.0511) #源mac bia aabb.cc00.0511
Internet address is 192.168.1.1/24
MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:02, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
112 packets input, 34284 bytes, 0 no buffer
Received 103 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
593 packets output, 64520 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
R2#sh int e1/1
Ethernet1/1 is up, line protocol is up
Hardware is AmdP2, address is aabb.cc00.0611 (bia aabb.cc00.0611) #目的mac bia aabb.cc00.0611
Internet address is 192.168.1.2/24
MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output 00:00:05, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
111 packets input, 33444 bytes, 0 no buffer
Received 101 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
567 packets output, 61276 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
#wireshake抓包
Frame 111: 114 bytes on wire (912 bits), 114 bytes captured (912 bits) on interface 0
Ethernet II, Src: aa:bb：cc:00:05:11 (aa:bb:cc:00:05:11), Dst: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Destination: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast) # IG=0，单播，判断目的mac地址是否为接口mac
Source: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800) #数据包由ipv4协议处理
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.2
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 100
Identification: 0x000a (10)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don‘t fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: ICMP (1) # ipv4协议类型为 ICMP
Header checksum: 0x383b [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.1.1
Destination: 192.168.1.2
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol #icmp封装失败
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xc71c [correct]
[Checksum Status: Good]
Identifier (BE): 2 (0x0002)
Identifier (LE): 512 (0x0200)
Sequence number (BE): 0 (0x0000)
Sequence number (LE): 0 (0x0000)
[No response seen]
[Expert Info (Warning/Sequence): No response seen to ICMP request]
Data (72 bytes)
Frame 112: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
#Ethernet II, Src: aa:bb：cc:00:06:11 (aa:bb：cc:00:06:11), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: ARP (0x0806)
Padding: 000000000000000000000000000000000000
Address Resolution Protocol (request)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Sender IP address: 192.168.1.2
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00) #请求目的Mac,
Target IP address: 192.168.1.1
Frame 113: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
#Ethernet II, Src: aa:bb：cc:00:05:11 (aa:bb:cc:00:05：11), Dst: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Destination: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: ARP (0x0806)
Padding: 000000000000000000000000000000000000
Address Resolution Protocol (reply)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
Sender MAC address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Sender IP address: 192.168.1.1
Target MAC address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Target IP address: 192.168.1.2
Frame 115: 114 bytes on wire (912 bits), 114 bytes captured (912 bits) on interface 0
#Ethernet II, Src: aa:bb:cc:00:05：11 (aa:bb:cc:00：05:11), Dst: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Destination: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
Address: aa:bb:cc:00:06:11 (aa:bb:cc:00:06:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
Address: aa:bb:cc:00:05:11 (aa:bb:cc:00:05:11)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.2
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 100
Identification: 0x000b (11)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don‘t fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: ICMP (1)
Header checksum: 0x383a [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.1.1
Destination: 192.168.1.2
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xbf48 [correct]
[Checksum Status: Good]
Identifier (BE): 2 (0x0002)
Identifier (LE): 512 (0x0200)
Sequence number (BE): 1 (0x0001)
Sequence number (LE): 256 (0x0100)
[Response frame: 116]
Data (72 bytes)
标签：arp
原文地址：http://f1yinsky.blog.51cto.com/12568071/1958197
