ARP request gets sent out to broadcast address. You can see the source address.<br />
Response comes back. You can see some bytes of the destination address correspond to some translated bytes of the original request source, and the rest are crap.<br />
<br />
00:00:00.303841 18:af:61:b7:ea:f2 > Broadcast, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.98.85.162 tell 10.98.85.1, length 46<br />
00:00:00.000113 cf:ff:81:00:10:55 > ea:f2:00:0c:bd:05, ethertype ARP (0x0806), length 56: Ethernet (len 6), IPv4 (len 4), Reply 10.98.85.162 is-at 00:0c:bd:05:cf:ff, length 42
↧