Packet Builder: ARP packets

[zezar]

Hi, can somebody answer the following question:

When I send an ARP packet (Request) I get correct reply (I analyse that with WireShark), but there no entry appears in ARP table (command line and "arp -a").

When is the ARP table created?

I use WinXp.

[Nelson]

I think you did not send the ARP request from command line in windows but some third party tools like colasoft pktbuilder of pktplayer.



Only hold the cache for the IP subnet I configured.
you will never see a ARP entry like 192.168.1.1 00-12-58-4A-7F-c6 when 192.168.1.1 is not in the same subnet with your IP address. This is determined by the IP address and subnet mask on the NIC configuration.

Of course there are other restrictions but the most likely one in your scinaro is you did not send the request through the windows itself.
If you have a slow response, you will be able to the there is a entry like
192.168.1.1 00-00-00-00-00-00 invalid
which was created just after windows send the ARP request, and reserved some space from RAM, and it would be filled with the right MAC address as soon as the response reached the sender.
Considerated if the request does not send from the windows itself, will there be a reserved space for you to fill the returen MAC?