So far I know that if Wireshark does not display ARP frames before ICMP frames, it's usually because there are ARP requests in the cache.
I did check the cache and deleted any ARP data in the cache:
sudo arp -d -a
Then, I start Wireshark, add a filter: arp or icmp to filter out any traffic except ARP or ICMP data. After that, I try to run a simple ping request:
ping -c4 www.google.com
Which works, and Wireshark successfully displays ICMP data. But there is no ARP information right before the ICMP data even after I clear the ARP cache.
Any other reasons why this is happening?
برچسب:
نویسنده: استخدام کار