Quote Originally Posted by toppshatta
Well i read the aritcles - very intersting.I checked the arp packets like u said, strangely though i realised that none of them this time had a destination address
all they were doing was my router was querying the mac address of 10.0.0.3 ( which is my ethernet card), and 10.0.0.3 replying with the mac address.
I also noticed that watever address i put for the broadcast address on knoppix 4.02 worked, with no problems. I also did arp -n in shell and noticed that the only address i have in the arp cache is my router 10.0.0.1.I logged into my router and looked at the settings, i found this. I am not sure if it will be useful.

WAN Statistic:
IP Address Subnet Mask MAC Address
172.26.12.163 255.255.0.0
....
Normally there should be some packets that go out to a broadcast address (not to a specifiic MAC address) that ethereal translates to something like "who has 10.0.0.3" and the computer with that address is expected to respond. This is how the routing tables get populated with the mac addresses in the first place. You may see more of this activity if other computers are turned on and if they try to do anything to your IP address, even a ping (or any local IP address, even one that is not in use, although there will obviously be no response for the ones not in use).

You should be able to watch the DHCP handshake if you do another netcardconfig after ethereal is started (I've actually never done this; I have observed the DHCP handshake on other systems as they start with the use of a hub to "sniff the wire", but I've never had occasion to watch my own DHCP handshake).

The subnet mask above does tell me something. You may remember that I said the 255.255.255.0 mask you use is common for class C routers but not often used for routers that use a 10 class address. Most home routers use an address in the 192.168.xxx.xxx range and use a 255.255.255.0 mask. This allows them an address space of 256 IP addresses including the loopback and broadcast address, supporting as many as 254 computers (although some of these routers save on memory and only support a smaller number of computers within this range). the 192.168 range is actuall a B class network, but it is sub-netted here to keep the router table sizes cost effective.

10 Class networks are A class networks and can support IP addresses from 10.0.0.0. to 10.255.255.255 (this large block is reserved for private networks and is not routable across the Internet). But since this would involve huge router tables, it is almost always divided into smaller sub-nets. This division is what the network mask is all about. As I hope you have already learned, the mask and the IP address together determine the broadcast address.

In your case you show a mask of 255.255.0.0. This is a very large network (65,534 computers) and is not typical of a home router. The thing is, a router at 10.0.0.1 and using a subnet mask of 255.255.0.0 should be sending out occasional broadcasts on the broadcast address of 10.0.255.255 and should be listening to that address for any other broadcasts ("who has 10.0.0.1" for example). Since your Knoppix system is listening for broadcasts and broadcasting itself on a broadcast address of either 255.255.255.255 or 10.0.0.255 and not 10.0.255.255 then it should not receive the broadcasts from the router and it's broadcasts should not recieve a response (by the way, are you forcing your NIC into permiscuious mode in ethereal? That may be what you need to do to see these off-target broadcasts, since otherwise the NIC will ignore them. Be sure to check your ethereal settings and run ethereal under root to make this work.)

So I'm still at a loss on why this works at all, and why it works well under 4.0.2. I don't know what your router is really broadcasting on or listening for broadcasts on (it should be 10.0.255.255 with that sub-net mask, but that is a much larger subnet than I would expect the router to support). I'm not real shocked that if the configuration is strange and everyone isn't agreeing on the same broadcast address that the system degrades in different ways for different versuions of Knoppix or other OSs. The important thing here is that all computers on the subnet have got to use te same broadcast address. The convention is that it's always the highest address based on the IP address and the mask. This is normally all taken care of for you by the router and DHCP so you don't need to look at it, but something is breaking down here and you want to get your ducks in a row and be sure that all computers on the sub-network (LAN) are using the same mask and broadcast address. You may or may not be able to change the mask in your router, but you should be able to manually make these settings in Knoppix and Windows if the DHCP handshake doesn't work.