This chapter focuses on ARP and IP analysis with WIreshark

1. NDI Communications - Engineering & Training
Network analysis Using Wireshark
Lesson 9 – ARP and IP Analysis

2. Page 2
Lesson Objectives
By the end of this lesson, the participant will be able to:
Understand ARP and IP
Isolate and fix basic IP/ARP networking problems

3. Page 3
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

4. Page 4
What is ARP
MAC AddressesIP Addresses

5. Page 5
How it Works?
192.168.1.1
AA-C1-23-DC-B8-C9
192.168.1.2
BB-C1-23-A1-B8-C9
192.168.1.3
CC-C1-23-F5-B8-C9
192.168.1.4
DD-C1-23-65-B8-C9
ARP Request
Ping (ICMP): 192.168.1.1  192.168.1.3
ARP Reply

6. Page 6
Example
172.30.116.253 is
looking for .254
172.30.116.100 is
looking for .254

7. Page 7
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

8. Page 8
IP Analysis Tools - Filters

9. Page 9
IP Name Resolution
Source name and address Destination name and address
Reload
Source and
destination
presented in
their names

10. Page 10
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

11. Page 11
What is Fragmentation
ID
=x
offset
=0
fragflag
=0
length
=4000
ID
=x
offset
=0
MF
=1
length
=1500
ID
=x
offset
=1480
MF
=1
length
=1500
ID
=x
offset
=2960
MF
=0
length
=1040
One large datagram fragmented to
several smaller ones
ID=X is equal to the
Whole frame
Fragment 1
Fragment 2
Fragment 3
DataDataData
Data
Original
packet
0
0
0
DF
=0
DF
=0
DF
=0

12. Page 12
When can Problems Accrue (Example)
PC2
S2S1
PC1
SP Network
Remote
office with
DB clients
Data Center
with DB
servers
IPSec & GRE Tunnel

13. Page 13
Captured File
Fragmented
packet
Fragmented
packet

14. Page 14
Fragmentation Example
Fragmented Packet
Fragmented Packet
Fragmented Packet
Packet fragmentation
details

15. Page 15
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

16. Page 16
Routing Problems (Example)
S2S1
Data
Center
Communication Lines
(Service Provider)
office
1
Network 10.50.0.0/16
Network 10.20.0.0/16
Network 10.10.0.0/16
RDC
R1
R2
office
2

17. Page 17
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

18. Page 18
Duplicate IP - Example
Duplicate IP
discovered
Which is also used
in another MAC
address
In this case due
to gratuitous ARP
…

19. Page 19
Chapter Content
Analysing connectivity problems with ARP
Using IP traffic analysis tools
Finding fragmentation problems
Analysing routing problems
Finding duplicate IPs
Analysing DHCP problems

20. Page 20
DHCP Principles of Operation
The same transaction ID
for the DHCP process
The DHCP process:
Discover – Offer – Request -
Ack

21. Page 21
Summary