( rev. 12/26/2007 )

Looking Up Information On A Local Ethernet

AGGREGATE ARP

For this lab you can work in a team of two persons, or you can work solo.

Scan the man page for arp. On one of the sun ultra's, do arp -a. Capture the output in a file and insert comments under the lines that contain the flags P, S, or M. In your comments explain why the flags are in those entries and what they mean. You should be able to get most of the information you need from the man page, but you may ask for help.

ARP-AT-A-TIME

You can use arp to learn the ethernet address of a network interface. A command of the form

arp hostname

will display the current arp entry for hostname. You can use a domain name like centauri or centauri.csustan.edu for hostname. You can use the IP number (e.g. 130.17.70.10) of the host, if you know it, instead of a domain name.

In some cases you will be logged into a host H and you will do an arp X but there will be no arp entry on H for X. In that case you only need to do something that will cause H to interact with X. Usually it's easiest just to ping X. Here is an example: 
john@altair: arp vega
vega (130.17.70.23) -- no entry
john@altair: ping vega
vega is alive
john@altair: arp vega
vega (130.17.70.23) at 8:0:20:9f:87:c2
john@altair:
Does what you read about ARP in the textbook explain what happened in the interaction above? Why did altair say "no entry" before we ping'd vega? What happened 'below the surface' that caused altair to have the information to answer after the ping command? put your answer in your capture file

Now you try some arp commands. Use arp to get ethernet addresses on the following hosts: Add the text of your interaction to the end of your file so it shows a script of how you got the ethernet addresses of the hosts indicated by the IP numbers above.

DIG and NSLOOKUP

Scan the man pages for dig and nslookup. Use commands such as

dig -x 130.17.70.35

or

nslookup 130.17.70.35

to learn the domain names of the hosts identified above by IP number.

Add the text of your interaction to the end of your file so it shows a script of how you got the domain names of the hosts indicated by the IP numbers above. Also, put a filled-in version of this display at the bottom of your capture file: PORT STATUS

Next scan the man page for netstat and then do the command netstat -f inet. Append a copy of the resulting display to the end of your capture file. Below that add a comment explaining (I mean really explain: make it instructive) the meaning of the command, and the meaning of each of the columns in the display. Get help by using information from the man page and knowledge you have gained from reading about TCP/IP in your textbook. (You should be beyond chapter 25 by now.)

NETWORK INTERFACE STATUS

Now do the command netstat -i. Are collisions less than 3% of output packets, and are other errors no more than half a percent of total packet volume? Excessive collisions are evidence that the network is overloaded. Other errors can be symptomatic of problems with the physical connections of the network hardware components.

Your computer has only one network interface card. Do you know why the command gives information about two network interfaces? Why does it give two sets of information for each interface?

Put your answers to the questions above in your capture file.

LAB REPORT

Send your capture file record to me at this address: john@ishi.csustan.edu. Make sure the subject of the e-mail reads:

Ethernet Lab

Put your name at the top of the file before sending. If you worked with a partner be sure to put his or her name there too.