05Mission Tech Act 1

Networking Zero to Hero | Session 5

ARP, Request to Resolution

Prove the full ARP state transition from an empty neighbor cache to a captured broadcast request, unicast reply and kernel-resolved mapping.

Start the labDownload lab runnerPublic lab docs
Time40 to 55 minutes
EnvironmentWSL2 Ubuntu
StackARP, neighbor cache, Ethernet, PCAP
OutputLocal PCAP plus evidence
00

Watch an IP become a MAC

Start with an empty neighbor cache, capture the broadcast question and unicast answer, then prove the learned mapping.

Tool

Predict who-has and is-at with the ARP simulator.

Kernel

Compare an empty and resolved neighbor table.

PCAP

Prove request broadcast and reply unicast fields.

01

Write the ARP conversation

Prediction203.0.113.10 asks who has 203.0.113.20. The request uses the Ethernet broadcast destination. The reply identifies MAC 02:00:00:05:00:20.
02

Build two ARP peers

Ubuntu
chmod +x mission-act1-labs.sh
sudo ./mission-act1-labs.sh lab05 doctor
sudo ./mission-act1-labs.sh lab05 build
sudo ./mission-act1-labs.sh lab05 flush
Initial proofThe client neighbor table should be empty before the first exchange.
03

Capture request and reply

Capture
sudo ./mission-act1-labs.sh lab05 capture
sudo tcpdump -nn -e -vv -r results/*-lab05/arp-request-reply.pcap
Request
Broadcast: who has 203.0.113.20?
Reply
Unicast: 203.0.113.20 is at 02:00:00:05:00:20.
04

Prove the cache changed

Resolve and verify
sudo ./mission-act1-labs.sh lab05 resolve
sudo ./mission-act1-labs.sh lab05 verify
Reasoning checkpointA second IP exchange can reuse the cached mapping. Do not expect a new ARP request until the entry is removed or expires.
05

Answer the gateway question

A host ARPs for the next local hop, not for a remote internet server. The routing table chooses that next hop first.

Exit statementExplain which address the host resolves when the destination lies outside its connected prefix.
06

Close cleanly

Cleanup
sudo ./mission-act1-labs.sh lab05 destroy