Quiz 2 questions (2/24)

[mary talpas]

What does the C flag mean when viewing ARP cache entries with arp -n?

What Wireshark display filter would only show ARP and ICMP protocol packets?

With an IP address of 172.30.4.100 and a netmask of 255.255.0.0, what is the broadcast address?

[mary talpas]

1) complete - Temporary arp cached entries are aged out after several minutes

2) use icmp or arp as a display filter to view only those packets

3) 172.30.255.255

[brynden hutmacher]

Isn't the answer to question 3 172.30.251.255???

[Tyler Bahn]

[quote="brynden hutmacher"]Isn't the answer to question 3 172.30.251.255???[/quote]
Actually no, with a netmask of 255.255.0.0 this is a class B network (or /16). The first 2 octets are the network portion of the IP and the last 2 octets are the host portion.

The broadcast address always uses the address which has all ones in the host portion of the address. Let's see what it looks like in binary:
[code]
netmask: 255.255.0.0 = 11111111.11111111.00000000.00000000
network IP: 172.30.0.0 = 10101100.00011110.00000000.00000000
host IP: 172.30.4.0 = 10101100.00011110.00000100.00000000
broadcast IP: 172.30.255.255 = 10101100.00011110.11111111.11111111
[/code]
Because of the netmask, the first 2 octets of the address are locked, any address in this network will start with 172.30 (this is the network portion of the address). the remaining 2 octets represent the host portion of the address (which is variable). The network address will always use the IP address that has all zeros in the host portion of the address.

Please let me know if I have any part of this wrong.

Thanks,
Tyler