Wireshark Lab Analysis

Solution to Wireshark Lab: Ethernet and ARP 1. What is the 48-bit Ethernet address of your computer?
The Ethernet address of my computer is 00:d0:59:a9:3d:68
2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468–469 in the text and make sure you understand the answer here.]
The destination address 00:06:25:da:af:73 is not the Ethernet address of gaia.cs.umass.edu. It is the address of my Linksys router, which is the link used to get off the subnet.
3. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s) whose value is 1 mean within the flag field?
The hex value for the Frame type field is 0x0800.
4. How many bytes from
The ARP opcode field begins 20 bytes from the very beginning of the Ethernet frame.
b) What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP response is made?
The hex value for opcode field withing the ARP-payload of the request is 2, for reply.
c) Where in the ARP message does the “answer” to the earlier ARP request appear – the IP address of the machine having the Ethernet address whose corresponding IP address is being queried?
The answer to the earlier ARP request appears in the”Sender MAC address” field, which contains the Ethernet address 00:06:25:da:af:73 for the sender with IP address 192.168.1.1.
14. What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP reply message?
The hex value for the source address is 00:06:25:da:af:73 and for the destination is 00:d0:59:a9:3d:68
15. Open the ethernet-ethereal-trace-1 trace file in