1

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?

2
  • 2
    What are you using to monitor? You need to configure your wireless device to run in “monitor “ mode. It’s equivalent to promiscuous mode for an Ethernet sniffer.
    – Ron Trunk
    Oct 2, 2018 at 13:00
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:40

2 Answers 2

1

I don't know how do you monitor ARP packet but I think what you see is correct. Here are the reasons:

First, you ARP request packet will be broadcast to LAN by switches. Your computer only needs to send one ARP request packet and the broadcast is done by switches. So the monitor shows your ARP request packet as an indication for this step.

Second, the gateway router sent the ARP reply packet to you (unicast because the switch is self-learning) by the switches. So the monitor only shows ARP reply packet from the gateway router as the indication for this step.

0

You can add a TAP between your access point and the switch. Of course you can set a monitor session on all Wi-Fi interfaces. I think it’s the simple way to monitor packets transferred by your network. You will be able to see ARP because you AP by default just pass through all packets except beacons.

1
  • 1
    There are quite a few frames besides beacons that a AP will not forward.
    – YLearn
    May 12, 2019 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.