Network › Module 6 › Lesson 4
Lab — Read YOUR ARP Table
Lab: arp -a and Get-NetNeighbor on THIS host only — never a /24 scan.
Visual · arp_table_lab
Hands-on: read THIS host's ARP/neighbor table. http://192.168.0.1/ YOUR lab. Original Cyberlium.
Opening
The lab is a read. If a command would send a lie or sweep a subnet, it is the wrong lab.
You will dump THIS computer's neighbor table, name the default-gateway row, and store a chmod 600 note. That is the whole lab. No arpspoof. No ettercap. No nmap 192.168.0.0/24. No “just one flood to see timeouts.” Original Cyberlium.
1. Dump THIS host, not the neighborhood
Run arp -a and, on Windows, Get-NetNeighbor. On Linux/macOS, ip neigh show. You are listing what this OS already learned. You are not asking every address on a /24 to reply.
If the table is nearly empty, you may be on a VM with no IPv4 gateway. Write that fact. Do not “fix” emptiness by scanning a café.
Command guide
Dump THIS host, not the neighborhood
═══ COMMANDS ═══
Command — copy this
arp -a powershell.exe -NoProfile -Command "Get-NetNeighbor | Select-Object IPAddress,LinkLayerAddress,State,AddressFamily | Format-Table -AutoSize" || ip neigh show
2. Circle the default-via row in a file you own
Print THIS host's default route. Copy the via IP into your note. Find that IP in the dump. Record IP, MAC, interface, and UTC time. That tuple is the lab deliverable.
Do not log into a home router to “get a better MAC” if heading 1 already STOPPED you at Router Admin for the demo URL. The table on THIS host is enough.
Command guide
Circle the default-via row in a file you own
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
Built-in (iproute2)
macOS:
Command — copy this
brew install nmap
Use: ifconfig
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Use: ipconfig
═══ COMMANDS ═══
Command — copy this
powershell.exe -NoProfile -Command "Get-NetIPConfiguration | Select-Object InterfaceAlias,IPv4DefaultGateway | Format-List" || ip -4 route show default
3. Optional: confirm loopback teaching, then stop
If you started the Topic 11 teaching listener, curl That proves a local TCP path. It does not prove ARP. Do not bind that listener to 0.0.0.0.
Wrap the lab: chmod 600, date stamp, refusal line. Then take the quiz. There is no extra credit for a LAN sweep.
Command guide
Optional: confirm loopback teaching, then stop
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
s = socket.socket(); s.settimeout(0.5)
print("loopback:8785", s.connect_ex(("127.0.0.1", 8785))); s.close()
print("lab done: table dump + gateway-row note; no /24, no arpspoof")
PY4. What you ship: a dump and a circled gateway row
Evidence: arp -a and/or Get-NetNeighbor/ip neigh output saved. Gateway IP/MAC/iface dated. chmod 600. No nmap /24. No spoofing tools. Loopback bind only if you run a listener.
5. What you record before the next lesson
Files: t11-m06-l04-gateway-row.txt plus snapshots. DEMO identified/STOP. NEVER ettercap/arpspoof/hping3/0.0.0.0. Next: Quiz — ARP Trust.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
nmap -sn 192.168.0.0/24 to “populate ARP.” ettercap unified sniffing. python HTTP server --bind 0.0.0.0 “so the lab is visible.”
Right
Read THIS host. Fill the gateway-row note. Stop. Next: Quiz — ARP Trust.
Mission: read YOUR ARP table
1) / STOP if router. 2) Run arp -a and Get-NetNeighbor (or ip neigh) on THIS host. 3) Fill default via IP + MAC in cyberlium-lab. Never scan. Never spoof. Never bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
If Get-NetNeighbor errors in Git Bash, ask Mentor how to call powershell.exe -NoProfile — not how to scan the apartment building.
Knowledge Check
APPLY: The lab VM has an empty ARP table. What is in-scope?
Multiple choice
Knowledge Check
APPLY: True or False: Get-NetNeighbor on THIS Windows PC is an authorized lab command in this lesson.
True or False
Knowledge Check
APPLY: A classmate says bind the teaching server to 0.0.0.0 so they can watch your ARP lab. You:
Multiple choice