1

I set my WIFI interface to monitor mode.

I did not expect to see any ARP requests.

Can someone explain why there is ARP traffic?

Traffic captured with Wireshark

Improve this question
5
  • 3
    Why did you not expect it? You are seeing all traffic between hosts. – Ron Trunk Nov 17 '19 at 15:33
  • It's your network - you should know who's on and what they're doing. – Zac67 Nov 17 '19 at 15:38
  • Since ARP requests use broadcast, your host receives and processes ARP requests, even if you are not in monitor mode. – Ron Maupin♦ Nov 17 '19 at 15:42
  • @RonTrunk I am not connected to any network. I am just monitoring nearby wifi traffic. I did not expect to see ARPs since I am not connected to any network. – Felix PK Nov 17 '19 at 15:52
  • That’s what monitor mode means. You see all traffic on that channel. – Ron Trunk Nov 17 '19 at 16:16
0

For a host to send something to another host on the same layer-2 LAN, it must use the layer-2 addressing to do that. Wi-Fi uses MAC addressing as its layer-2 addressing. IPv4, when sending to another IPv4 address, must resolve the IPv4 address to the MAC (layer-2) address on Wi-Fi. It uses ARP (Address Resolution Protocol) to do that.

ARP maintains a table of IPv4 to MAC addresses for each interface in a host. If there is no entry for a particular IPv4 address (entries have a limited lifetime, then time out of the table), ARP will send a broadcast ARP request to all hosts on the LAN asking who owns the particular IPv4 address. All the hosts receive and process the ARP request, and the host that owns the IPv4 address will reply with its MAC address.

The original host will then use the received MAC address to encapsulate the IPv4 packet into the Wi-Fi frame to send to the destination host.

If you monitor all the traffic on a LAN, you should see many ARP requests as hosts send to other hosts on the LAN. ARP is necessary for IPv4 on most LAN protocols to get the destination LAN address in order to build a frame.

That only applies to IPv4. IPv6 uses NDP (Neighbor Discovery Protocol) to get the MAC address of the destination. NDP is more efficient because it does not interrupt every host on the LAN, forcing them all to process a request. NDP uses multicast based on the IPv6 address of the destination host, and it probably only interrupts the destination host, or possibly very few other hosts.

Improve this answer
4
  • Does that mean that I also should be able to see ARP requests inside my local network? Eg. Who has 192.168.178.28 tell 192.168.178.1? How would that show up on an interface in monitor mode? – Felix PK Nov 17 '19 at 16:17
  • Yes. ARP requests are broadcast frames, meaning that every host on the layer-2 broadcast domain will see and process the ARP requests. The ARP replies are unicast, so you can only see those on a shared medium, e.g. Wi-Fi. – Ron Maupin♦ Nov 17 '19 at 16:19
  • If my home router is asking Who has 192.168.178.28 tell 192.168.178.1 shouldn't I see exactly this request with my interface in monitor mode? With all tests I did, I could not verify this behaviour. I made sure the monitor antenna is on the same channel as my router. Regarding the ARP from 10.70.24.1 in my OP: What conclusions can I draw from this request? Is it originated from a private local network? Why can I see this ARP request but not the ones that are in my local network? – Felix PK Nov 24 '19 at 14:06
  • Unfortunately, questions about home networking and consumer-grade devices are explicitly off-topic here. You could try to ask about the specifics of what you have set up and what you are or are not seeing on Super User for a home network. – Ron Maupin♦ Nov 24 '19 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.