<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1256"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>This would probably be easier if you posted the details of the four packets.</div><div><br></div><div>-- Murphy</div><br><div><div>On Jun 23, 2015, at 6:54 PM, Talal Alharbi <<a href="mailto:tal012@hotmail.com">tal012@hotmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div class="hmmessage" style="font-size: 12pt; font-family: Calibri; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div dir="ltr">Dear All,<span class="Apple-converted-space"> </span><br><br>Running a test on L2_learning module and trying to send an ARP packet from a host using Scapy. After sending an ARP request from host#1 to host#2, I checked Wireshark and I have found 4 packets:<span class="Apple-converted-space"> </span><br><br>1- Broadcast ARP request <span class="Apple-converted-space"> </span><br>2- Unicast ARP reply<span class="Apple-converted-space"> </span><br>3- Unicast ARP request<span class="Apple-converted-space"> </span><br>4- Unicast ARP reply<br><br>Why do I have the third packet? Who is sending it ? I used scapy command: arp = ARP(op=1, psrc=host1, pdst=host2, hwdst= mac address of host2)<br>Cheers,<span class="Apple-converted-space"> </span><br>Talal</div></div></blockquote></div><br></body></html>