I did a capture and am asked to show the ARP data and he DHCP data and then show which one is from the client and which one is from the server. How do I do this? asked 09 Nov '14, 08:21  MacTavish_10 edited 09 Nov '14, 08:22 |
One Answer:
You should familiarize yourself with how ARP and DHCP works. In both cases the client is the one asking for something: ARP usually asks for a MAC address for a known IP address, while DHCP asks for an IP address to be assigned to an interface. So if you see an ARP packet with "Who has... Tell..." it's the client. If you see a DHCP "Discover" it's the client, too. answered 09 Nov '14, 14:45  Jasper ♦♦ |
