network-programmingpingtcpdumparpicmp

Why can't I catch arp requests through tcpdump during ping?

I use tcpdump to capture a ping operation, and I can get the icmp packet of ping 8.8.8.8, but I cannot capture the arp request through tcpdump.I wonder if anyone knows the reason for this? Thanks~ enter image description here

Solution

  • ARP has a cache, and if the address is cached, there is no arp resolution going on.

    Also since you are routing to 8.8.8.8, ARP is needed to resolve the address of next router (interface), which is probably used for a lot of other packets, so its address is likely cached, so no ARP resolution is actually taking place.

    You can check this question on how to view arp cache.