This is our old Q&A Site. Please post any new questions and answers at

My Q:

On my first overall use I chose to view tcp vs http. Wondering what this might mean:

It says: Who has (xyz IP address)? tell (my IP address)

Source: dellpcba_f5:75:85 - destination: broadcast - protocol: ARP second: Source: Cisco_eb:db:dd - DellPcba_f5:75:85 - Protocol: ARP

Then it says: xyz IP address is @ 00:14:f1:eb:db:dd

Thank you.

asked 24 Nov '10, 09:47

valioop's gravatar image

accept rate: 0%

edited 24 Nov '10, 10:00

Check out some of the free Wireshark training courses we offer over at There are also some practice trace files and videos over at

(27 Nov '10, 14:34) lchappell ♦

This is an ARP Request and an ARP response, which basically means that the Dell PC is looking for the Ethernet MAC address of a Cisco Router, which probably is the default gateway. Even though the Dell PC is communicating from it's own IP to the target IP (on OSI layer 3) the actual frame needs to be transported by Layer 2 (Ethernet in this case), and for that the Dell PC asks for the Ethernet MAC to be able to send the packet. It is sort of a "name resolution" between layer 2 and 3.

permanent link

answered 24 Nov '10, 11:07

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Gotcha! :)

(24 Nov '10, 11:54) valioop
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Nov '10, 09:47

question was seen: 2,500 times

last updated: 27 Nov '10, 14:34

p​o​w​e​r​e​d by O​S​Q​A