TechKnowSurge
Cisco CCNA 1.13 Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8 CompTIA Network+ 1.4
TechKnowSurge Catalog Videos DEMO: ARP Requests (Wireshark)
VideoNetworkFree

DEMO: ARP Requests (Wireshark)

ARP requests and replies are captured live in Wireshark to show how devices broadcast MAC address lookups across a network and receive direct unicast responses. Real traffic from two connected machines confirms how the ARP process resolves IP addresses to MAC addresses at the packet level.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark provides a direct view into how ARP operates at the packet level on a live network. After clearing the ARP cache on a demo laptop to force fresh lookups, captured traffic is filtered by protocol to isolate ARP requests and replies. The first exchange visible in the capture shows the demo laptop broadcasting a request for the MAC address of a remotely connected working laptop, with the source MAC address verified against the output of ipconfig /all to confirm the packet's origin. The captured reply comes back as a unicast directly from the working laptop to the demo laptop, carrying the MAC address needed to complete the communication. This exchange illustrates the two-phase nature of ARP: a broadcast that reaches every device on the local segment, followed by a targeted reply sent only to the requesting host. Once the reply is received, the requesting machine stores the MAC address and can communicate directly without further lookups. The capture also shows ARP broadcasts originating from other devices on the network, including requests for IP addresses belonging to neither machine in the demonstration. These packets appear in the capture log because broadcasts reach all connected devices, but the corresponding replies do not, since those replies are sent directly between the devices involved. This behavior highlights a fundamental characteristic of ARP that has significant implications for network visibility and security.

What you'll learn

What's covered

ARP Requests in Wireshark

Aligned to

Cisco CCNA
1.13 Describe switching concepts
Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis
CompTIA Network+
1.4 Explain common networking ports, protocols, services, and traffic types

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Broadcast
A transmission type in which one device sends a single packet that is delivered to every other device on the local network segment simultaneously. Broadcast traffic is contained within a broadcast domain and does not cross router boundaries.
Unicast
A transmission type in which a packet is sent from one source directly to one specific destination device, identified by its unique IP or MAC address. Unicast is the standard delivery method for most internet traffic such as web browsing and file downloads.

Transcript

I'm going to use Wireshark to get a little glimpse at what those ARP requests actually look like. I'm going to be looking at the Wi-Fi connection on this demo laptop, and I'm going to pull up a command prompt and just clear the cache. So I'm going to clear the cache out, and that's going to refresh this, and it's going to start having to make those ARP requests to figure out those MAC addresses again.

Once that's done, I can stop this from collecting any more data. I'm going to click on the protocols tab. What this is going to do is sort everything by the protocol, and then I can scroll up and see all of the requests that are being made.

Now, I've got two machines here that are making a consistent connection, because I have my demo laptop, which you're seeing right here, and then I have my working laptop, which is actually remoted into this. So there's a live connection that's immediately going to reestablish a connection. It's going to do an ARP request to find out what the MAC address is of my working laptop.

Reading the request

So we see right here at the top, the first one that comes up is the source, and it's looked up what the maker of the network card is, and then it has the last digits of the MAC address. So just to verify, I'm going to pull this up and type in ipconfig /all, and see that my MAC address that's on here is in fact 94 5F. FF. So that's the same one.

So the source is from this demo laptop and the destination is being broadcasted out. That's the working laptop that has the connection that's established, and this is the demo laptop. So it sends this out as a broadcast everywhere, saying, hey, who belongs to this IP address? Tell me.

Then we see next there's a response from a Dell laptop, with the MAC address that's given right there, to the destination of what we've already confirmed is this demo laptop, and then the MAC address of the machine. So now this machine knows the MAC address. This demo laptop knows the MAC address of the working laptop. So there you have it, there's the ARP request.

Broadcasts versus replies

Now, if you scroll through there, you're going to actually see other ones as well. I'm going to point out this one right here: it's who has 192.168.42.1. That's neither the working laptop nor the demo laptop, it's neither of those. And so we can see that these broadcasts are reaching everyone. They do get broadcasted out to every device. This device received that broadcast and has logged it, but it didn't receive the reply, because the reply is direct from device to device. So the request gets broadcasted out, but the reply is only from device to device.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →