So let's see how the ARP packets are seen in Wireshark to see the ARP packets.
We must first force the system to send an ARP request.
Then we can have a close look into the fields of the ARP packets.
So I'm in Cali and I want to look at the ARP table first.
So I'll open a terminal browser and type ARP.
So this is the table of my collie.
There are two records at the moment, one for the gateway and one for the VM with the IP address of
207.
Let's clear the table first.
Now I don't have to delete the records of the ARP tables so I can use the H parameter to get help.
So it tells me to use the D parameter to delete a specified entry.
Now does it delete all the entries if I don't specify any particular one?
So I'll use the D parameter with no value.
And it needs the host name.
Okay, so I delete the entry for VM 207 so I can push it to create an ARP request.
Okay.
Deleted the entry.
Now run, Wireshark.
Now, remember, we run Wireshark within the terminal screen just as before.
So I'll click Wireshark Icon.
And that makes it run.
So double click the eth0 to start capturing the traffic.
Okay, now go to the terminal screen and ping VM 2007.
Turn back to the Wireshark interface.
And since we have enough packets to examine.
Let me just stop capturing.
So let's look at the first packet.
It's an ARP request.
When we ping the IP address.
172.16.99.207.
Since Kali doesn't know who has this address.
It broadcasts an ARP request to learn the owner of the IP.
And the second packet is an ARP response.
So go back to the request and expand the ARP packet information block.
The sender Mac address and the sender IP address are Cali's addresses.
The target.
Mac address is filled with zeros because, well, we don't know it yet.
When we look at the Ethernet frame, we see that the 48 bit destination address is full of ones and
all these F letters correspond to these ones in hexadecimal and the frame is broadcast, right?
Now this is the ARP response by VM 207.
And as you can see, the VM returns its Mac address in the sender Mac Address field to Collie.
And then as seen in the table, Kylie starts to send the ping requests to VM 2007 and then VM 2007 replies
to the requests.
Talk about clear communication.