I set my WIFI interface to monitor mode.
I did not expect to see any ARP requests.
Can someone explain why there is ARP traffic?
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this communityI set my WIFI interface to monitor mode.
I did not expect to see any ARP requests.
Can someone explain why there is ARP traffic?
For a host to send something to another host on the same layer-2 LAN, it must use the layer-2 addressing to do that. Wi-Fi uses MAC addressing as its layer-2 addressing. IPv4, when sending to another IPv4 address, must resolve the IPv4 address to the MAC (layer-2) address on Wi-Fi. It uses ARP (Address Resolution Protocol) to do that.
ARP maintains a table of IPv4 to MAC addresses for each interface in a host. If there is no entry for a particular IPv4 address (entries have a limited lifetime, then time out of the table), ARP will send a broadcast ARP request to all hosts on the LAN asking who owns the particular IPv4 address. All the hosts receive and process the ARP request, and the host that owns the IPv4 address will reply with its MAC address.
The original host will then use the received MAC address to encapsulate the IPv4 packet into the Wi-Fi frame to send to the destination host.
If you monitor all the traffic on a LAN, you should see many ARP requests as hosts send to other hosts on the LAN. ARP is necessary for IPv4 on most LAN protocols to get the destination LAN address in order to build a frame.
That only applies to IPv4. IPv6 uses NDP (Neighbor Discovery Protocol) to get the MAC address of the destination. NDP is more efficient because it does not interrupt every host on the LAN, forcing them all to process a request. NDP uses multicast based on the IPv6 address of the destination host, and it probably only interrupts the destination host, or possibly very few other hosts.
Who has 192.168.178.28 tell 192.168.178.1
shouldn't I see exactly this request with my interface in monitor mode? With all tests I did, I could not verify this behaviour. I made sure the monitor antenna is on the same channel as my router. Regarding the ARP from 10.70.24.1
in my OP: What conclusions can I draw from this request? Is it originated from a private local network? Why can I see this ARP request but not the ones that are in my local network?
– Felix PK
Nov 24 '19 at 14:06