CPSC 441, Networking, Fall 2004
Lab 9: ARP, Etc.
IN THIS LAB, you will use Ethereal and the arp command to investigate the ARP protocol. In the second part of the lab, you will run an experiment on data transfer through a hub and a switch.
The lab is due in class next Friday, November 19.
Part 1: ARP and Ethernet Addresses
For this part of the lab, you just need one computer that is connected to the campus LAN. In previous labs, you reconfigured your machines to make a make a small internet; you will have to change one of them back and reconnect it to the HWS LAN to do this lab.
The arp command is used to list the contents of a computer's ARP cache. Enter the command as "arp -n" or as "/sbin/arp -n" if you are not logged in as root. The "-n" stops arp from trying to look up a domain name for each IP address.
Question 1: Use the arp command to answer these questions:
(a) Find the MAC address of the Ethernet card in the computer cslab12.hws.edu (IP address 172.30.217.112). This machine will not be in your ARP cache unless you have tried to access it (for example by pinging it).
(b) What happens to the ARP cache if you try to access a non-existent IP address (such as 172.30.1.1)?
(c) Compare the ARP cache on your computer to the ARP cache on math.hws.edu and explain the difference. (You will have to log onto math.hws.edu and use the arp command in the form /sbin/arp -n)
(d) The arp command can be used to make entries into the ARP cache (although only if you are running as root). Read the man page for the arp command and look up the meaning of the "-s" option. Why might you want to use this option? What would happen if you used this option to add an incorrect Ethernet address to the ARP cache?Question 2: Do an Ethereal packet capture. While the packet capture is running, access a computer that is not already in your ARP cache. This will generate an ARP request and response. Stop the capture. Enter "arp" as the display filer, so that you only see ARP-related packets. Answer the following questions:
(a) Discuss the number of ARP requests that you see. Why are there so many? Where do they all come from? Why don't you see the responses to all these requests?
(b) What Ethernet address is used as the destination address in a broadcast packet?
(c) Find the ARP request that was sent by your computer. What is your computer's Ethernet address? How can you tell by inspecting the ARP request packet?
(d) Describe the "Info" in the ARP request and in the corresponding response, as displayed by Ethereal. What does it mean?
(e) What is the value of the "Type" field of an Ethernet frame that contains ARP data?
Part 2: Hubs and Switches
This part of the lab is a project for the class as a whole. After about 20 minutes, you should either finish Part 1 of the lab or put it aside for a while.
The principal difference between hubs and switches is that with a hub, all connected devices are in the same collision domain, while with a switch, each connection is a different collision domain. With a switch, it is possible for several pairs of computers to be communicating at the same time (although a cheap switch might not provide this capability).
What happens when two computers are sending data to two other computers through a hub at the same time? What do you expect to happen to the data transmission rates? What actually happens in practice? As a class, you should design and conduct an experiment to test this. I suggest that you use scp to transfer large files. The scp command reports how long the transfer takes. (You can find a few multi-megabyte files in http://math.hws.edu/local/.)
You should do the same experiment with one of the small switches that we have been using in the lab. Also, do the same thing with computers connected directly to the campus LAN.
Report on the design of your experiments, your observations, and your conclusions. The class as a whole should write the report; you can decide for yourselves how to divide up the work.