Observing ARP With The Windows CLI, IOS CLI, and Wireshark - ILM
Observing ARP With The Windows CLI, IOS CLI, and Wireshark - ILM
Topology
Addressing Table
Objectives
Part 1: Build and Configure the Network
Part 2: Use the Windows ARP Command
Part 3: Use the IOS Show ARP Command
Part 4: Use Wireshark to Examine ARP Exchanges
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Background / Scenario
The Address Resolution Protocol (ARP) is used by TCP/IP to map a Layer 3 IP address to a Layer 2 MAC
address. When a frame is placed on the network, it must have a destination MAC address. To dynamically
discover the MAC address for the destination device, an ARP request is broadcast on the LAN. The device
that contains the destination IP address responds, and the MAC address is recorded in the ARP cache. Every
device on the LAN keeps its own ARP cache, or small area in RAM that holds ARP results. An ARP cache
timer removes ARP entries that have not been used for a certain period of time.
ARP is an excellent example of performance tradeoff. With no cache, ARP must continually request address
translations each time a frame is placed on the network. This adds latency to the communication and could
congest the LAN. Conversely, unlimited hold times could cause errors with devices that leave the network or
change the Layer 3 address.
A network administrator should be aware of ARP, but may not interact with the protocol on a regular basis.
ARP is a protocol that enables network devices to communicate with the TCP/IP protocol. Without ARP, there
is no efficient method to build the datagram Layer 2 destination address. Also, ARP is a potential security risk.
ARP spoofing, or ARP poisoning, is a technique used by an attacker to inject the wrong MAC address
association in a network. An attacker forges the MAC address of a device, and frames are sent to the wrong
destination. Manually configuring static ARP associations is one way to prevent ARP spoofing. Finally, an
authorized MAC address list may be configured on Cisco devices to restrict network access to only approved
devices.
In this lab, you will use the ARP commands in Cisco routers and in Windows to display the ARP table. You
will also clear the ARP cache and add static ARP entries.
Note: The routers used with CCNA hands-on labs are Cisco 1941 Integrated Services Routers (ISRs) with
Cisco IOS Release 15.2(4)M3 (universalk9 image). The switches used are Cisco Catalyst 2960s with Cisco
IOS Release 15.0(2) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used.
Depending on the model and Cisco IOS version, the commands available and the output produced might vary
from what is shown in the labs. Refer to the Router Interface Summary Table at the end of this lab for the
correct interface identifiers.
Note: Make sure that the routers and switches have been erased and have no startup configurations. If you
are unsure, contact your instructor.
Instructor Note: Refer to the Instructor Lab Manual for the procedures to initialize and reload devices.
Instructor Note: Some of the ARP commands in Windows Vista or later operating systems will require
administrator privileges.
Required Resources
• 1 Router (Cisco 1941 with Cisco IOS Release 15.2(4)M3 universal image or comparable)
• 2 Switches (Cisco 2960 with Cisco IOS Release 15.0(2) lanbasek9 image or comparable)
• 2 PCs (Windows 7, 8, or 10 with terminal emulation program, such as Tera Term and Wireshark installed)
• Console cables to configure the Cisco IOS devices via the console ports
• Ethernet cables as shown in the topology
Note: The Fast Ethernet interfaces on Cisco 2960 switches are autosensing and an Ethernet straight-through
cable may be used between switches S1 and S2. If using another Cisco switch model, it may be necessary to
use an Ethernet crossover cable.
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Step 2: Configure the IP addresses for the devices according to the Addressing Table.
Step 3: Verify network connectivity by pinging all the devices from PC-B.
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
What is the physical address for the host with IP address of 192.168.1.2?
____________________________________________________________________________________
00-21-70-cf-3d-cc
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
d. In the Administrator command prompt window, type arp –d *. This command deletes all the ARP cache
entries. Verify that all the ARP cache entries are deleted by typing arp –a at the command prompt.
C:\windows\system32> arp –d *
C:\windows\system32> arp –a
No ARP Entries Found.
e. Wait a few minutes. The Neighbor Discovery protocol starts to populate the ARP cache again.
C:\> arp –a
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
b. Verify that an ARP entry for switch S1 has been added to the ARP table of R1.
R1# show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.1.1 - 503d.e5aa.c0a1 ARPA GigabitEthernet0/1
Internet 192.168.1.2 32 0021.70cf.3dcc ARPA GigabitEthernet0/1
Internet 192.168.1.3 13 0026.b9dd.0091 ARPA GigabitEthernet0/1
Internet 192.168.1.11 0 0009.b7e6.c040 ARPA GigabitEthernet0/1
Internet 192.168.1.12 40 0017.e02c.56c0 ARPA GigabitEthernet0/1
b. Verify that the ARP entry for PC-B has been added to ARP table of S1.
S1# show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.1.11 - 0009.b7e6.c040 ARPA VLAN1
Internet 192.168.1.12 44 0017.e02c.56c0 ARPA VLAN1
Internet 192.168.1.1 5 503d.e5aa.c0a1 ARPA VLAN1
Internet 192.168.1.3 17 0026.b9dd.0091 ARPA VLAN1
Internet 192.168.1.2 0 0021.70cf.3dcc ARPA VLAN1
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Fill in the following table with information about your first captured ARP packet.
Field Value
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Fill in the following table with information about your second captured ARP packet.
Field Value
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 9 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Reflection
1. How and when are static ARP entries removed?
_______________________________________________________________________________________
_______________________________________________________________________________________
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 10 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2
1800 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
1900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
2801 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
(F0/0) (F0/1)
2811 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
2900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many
interfaces the router has. There is no way to effectively list all the combinations of configurations for each router
class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An
example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be
used in Cisco IOS commands to represent the interface.
Device Configs
Router R1
R1#show run
Building configuration...
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 11 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
memory-size iomem 15
!
!
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
no ip address
shutdown
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
control-plane
!
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 12 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
!
end
Switch S1
S1#show run
Building configuration...
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 13 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 192.168.1.11 255.255.255.0
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 14 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
!
ip http server
ip http secure-server
!
line con 0
line vty 5 15
!
end
Switch S2
S2#show run
Building configuration...
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 15 of 16
Lab – Observing ARP with the Windows CLI, IOS CLI and Wireshark
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 192.168.1.12 255.255.255.0
!
ip http server
ip http secure-server
!
line con 0
line vty 5 15
!
end
© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 16 of 16