3

I am trying to test the ability for an embedded system to create DNS requests and process their replies, but I'm having problems getting those replies.

Physically, my embedded system (192.168.1.50) is connected to a switch, which is connected to a router (192.168.1.1). I have another computer, (192.168.1.31) connected to the same switch, on which I have Wireshark running.

I'm trying to send a DNS request to Google's public DNS server (8.8.8.8:53) from my embedded system. Having done a bit of reading, I'm not surprised that this request is repackaged as an ARP request to the router - Wireshark reports a who has 192.168.1.1? tell 192.168.1.50 message - but I receive no ARP reply from the router with its MAC address, which I think is what I'm expecting before the actual DNS request can be sent.

So, why is the router not replying?

I'm no network expert, so any simple help will be appreciated.

10
  • 6
    What makes you think it is not replying? The ARP request is broadcast, but the reply would be unicast. Your computer running Wireshark should not see the reply.
    – YLearn
    Mar 19 '14 at 22:22
  • 1
    Why don't you just replicate this DNS lookup on 192.168.1.31? YLearn is right, unless you're utilizing a hub or port-mirroring, you won't see a response.
    – Ryan Foley
    Mar 19 '14 at 22:36
  • Ok, that makes sense. So how can I see the reply? The only tools I currently have available are to step through with a debugger on the embedded platform (in which case I'm not really sure what I'm looking for) or Wireshark. Assume for a moment that the reply is being sent and I'm just not looking in the right place for it, what is the next thing I should be looking for, again, with these limited tools?
    – Ed King
    Mar 19 '14 at 23:12
  • 1
    @EdKing, as Fizzle mentioned, you would need a hub or switch that allows port mirroring. Aside from that, you could use a network tap, but to capture both directions with most of them, you would need a computer with two network interfaces.
    – YLearn
    Mar 20 '14 at 1:07
  • What kind of switch are you using? If its a Cisco switch, you cn enable port monitoring to capture the Arp reply.
    – Ron Trunk
    Mar 20 '14 at 1:33
-1

I have solved the issue. In fact, the reason that I was not able to receive ARP replies into my embedded system was because the switch was squashing them (I think this was because it was of a certain type). The solution was to place a downstream router of the switch and disable its firewall, thus creating another network within my LAN. I then requested the DNS server provided by the upstream router, through the downstream one. The downstream router does not squash ARP replies. To illustrate:

| NETWORK 1 -----------------------| NETWORK 2 --------------------|
| 192.168.1.50 --> 192.168.1.11   -|--> SWITCH --> 192.168.1.1    -|-->
| E.SYSTEM     --> DSTREAM ROUTER -|--> SWITCH --> USTREAM ROUTER -|-->

The upstream router knows a primary DNS server at 192.104.4.10, so the request was formulated from the embedded system with these IP addresses:

IP:      192.168.1.50
Gateway: 192.168.1.11
Subnet:  255.255.255.0
DNS:     192.104.4.10

Thank you for the comments, they helped me to debug this.

2
  • 3
    I'm afraid this doesn't make much sense. You are suggesting that a switch (which is designed to propagate ARP requests) is dropping ARP packets, and a router (which is designed to drop them) is passing them on.
    – Ryan Foley
    Mar 21 '14 at 10:35
  • As I've said, I'm no network expert, but without the second router, I don't get an ARP reply through the switch - neither from my embedded system or if I just plug a PC into it and arping. I do get an ARP reply if I move to another PC that doesn't go through this switch. The only way I could get my system to work was to use the downstream router.
    – Ed King
    Mar 21 '14 at 10:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.