How does Bob get Sally's IP address?

[rover18]

In the first chapter, there is a instance to explain how two users(Bob and Sally) communication with each other.But I have a question. How does Bob know the 192.168.0.3 IP address is Sally's and get it before the name is resolved? Can you give me a explanation,Todd? Thanks!

[lammle]

I don't have the book with me and I am not sure the exact example I used, but it woudl go something like this: Bob has telneted to Sally. Bob types in telnet Sally. The first thing that happens is name resolution, typically using DNS. Now Bob know Sally's IP address and basic IP routing occurs.
Cheers!
Todd

[rosen]

well if u have a look at the output of the network analyzer on page 6 the protocol field says "nbns"

That essentially means its a netbios naming service thats providing u as to what is the ip address of the computer that has the name sally.

[bs_kwaj]

I had the same question about Bob getting Sally's IP address.

On page 5 Bob broadcasts to .255 for "NB SALLY". There is no indication in the paragraph that that returned 192.168.0.3. It just magically showed up in the ARP request for the MAC.

The wording in there, on Page 5, is a little lacking in that regard.

Looking at rosen's reply, on page 5 (not page 6) the response from Sally is after the fact that Bob magically got the 192.168.0.3 in the previous paragraph. How did he know to to ask "who has 192.168.0.3"?

Or so it seems to me, considering a logical, chronological flow.



(I've posted a few times on this forum some time back, but then I had to go do some work a couple of times somewhere on the planet and then I had to work on my Security+ Certification. 865 out of 900!! woo hoo
Now, I'm back to this CCNA study!)

[saviola-1983]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

[Rnadyou]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

You are right~! , Thank you for your brilliant explaination~!
I understood now~! 3Q~!

[Bartzy]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)


But why doesn't Sally take Bob's MAC Address from this packet in the first place ?
srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


It has the source IP and the source MAC, why Sally doesn't recognizes that and puts it in its ARP cache and use it ?

Thank you.

[saviola-1983]

But why doesn't Sally take Bob's MAC Address from this packet in the first place ?
srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


It has the source IP and the source MAC, why Sally doesn't recognizes that and puts it in its ARP cache and use it ?

Thank you.


It's just because no one would cache "IP<->MAC" when receiving non-ARP packets.

That's why ARP Request is a must, and this behavior is by design.

[Bartzy]

Thank you !

[i2omani]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

Do i really need to read all about NetBIOS to understand this?
i have read for more that 3 hrs about NetBIOS and didn't even came close to what you are explaining here?

[lammle]

NetBIOS is just a name resolution method that Microsoft can use on LAN's.
Typically we'll only use DNS.
However, the idea of that discussion is not about name resolution, but how Bob has to find Sally's IP address (DNS, WINs, NetBIOS - doesn't matter how that happens, nor is that important to the CCNA objectives), and then how he resolves her MAC address so he can finally communicate to her PC.
Todd Lammle

[gonzalo]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

Hi Saviola,

I just started reading the book, and something didn't make sense with the way the process was explained in the book. Step 2 of your explanation makes sense to me, but step 2 in the book does not. It says that BOB sends a broadcast to the LAN (ARP) to get Sally's MAC address, when in fact it is SALLY that receives the NBNS Name Query request for "SALLY", and wants to unicast reply back to BOB, but first SALLY needs to do an ARP to resolve BOB's IP to a MAC, so that SALLY can send the unicast NBNS reply back to BOB.

I came on this site to see if I was the only one that had trouble understanding the process as per the book, and it seems clear to me that it is simply a mistake in the book. Feel free to correct me!

Thanks
Gonzalo

[gonzalo]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

Testing... replied to a post and it got lost!!

[gonzalo]

1. Bob -> Broadcast (NetBIOS Name Query)

That's an NetBIOS name query, in order to resolve IP address of the NetBIOS name "Sally" by broadcast (if no WINS or DNS used, and "Sally" is not in hosts or NetBIOS cache).

The packet is like:

srcMAC=Bob's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
srcIP=192.168.0.2; dstIP=192.168.0.255
srcPort=137(UDP); dstPort=137(UDP)
Name Service Operation Code=0x00 (Query)
in the query section, Name=Sally, Type=0x0020 (NB)


2. Sally -> Broadcast (ARP Request)

Because Sally received the broadcast NetBIOS name query, she wants to reply to 192.168.0.2 (the srcIP of the NetBIOS name query), but she don't know it's MAC address (if not in her ARP cache).
So, she first send an ARP Request.

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=FF:FF:FF:FF:FF:FF
Ethertype=0x0806 (ARP)
ARP Operation=0x0001 (ARP Request)


3. Bob -> Sally (ARP Response)

That's an (unicast) ARP Response, to tell Sally: 192.168.0.2's is at Bob's_MAC

The packet header is like:

srcMAC=Bob's_MAC; dstMAC=Sally's_MAC
Ethertype=0x0806 (ARP)
ARP Operation=0x0002 (ARP Response)


Now, both 192.168.0.2 and 192.168.0.3 got other's MAC (saved in ARP cache).


4. Sally -> BoB (NetBIOS Name Reply)

This is an NetBIOS Name Reply, to tell Bob: Sally's IP Address is 192.168.0.3
It's a unicast to 192.168.0.2, that's why sally must first send the ARP Request!

The packet header is like:

srcMAC=Sally's_MAC; dstMAC=Bob's_MAC
srcIP=192.168.0.3; dstIP=192.168.0.2
srcPort=137(UDP); dstPort=137(UDP)


5. Bob -> Sally (Start to talk)

Now Bob got the IP Address of NetBIOS Name "Sally", and cached it in his NetBIOS cache.
It can be checked by "nbtstat -c".

Bob also have 192.168.0.3's MAC in his ARP cache (got by Sally's ARP Request).
It can be checked by "arp -a"

Sally also have 192.168.0.2's MAC in her ARP cache (got by Bob's ARP Response).

Sally still don't know 192.168.0.2 is Bob(NetBIOS Name), or Bob is 192.168.0.2, but that doesn't matter !

Bob can now send unicast packets to Sally(192.168.0.3), and Sally can answer to 192.168.0.2(although she don't know who she is talking with)

Hi Saviola,

The way you described how the name resolution process works, is how I understand the process to work now that I've done my own packet capture.

In page 5, it shows that the name resolution process begins with a NBNS query from 192.168.0.2 to the broadcast for the name
SALLY. The next step, according to the book, is an ARP lookup from 192.168.0.2 for 192.168.0.3. This is the bit that didn't make sense to me,
as supposedly BOB doesn't know SALLY's IP or MAC address yet, so where did 192.168.0.3 come from?

Through the packet capture, I found that the correct procedure that makes sense is that BOB (192.168.0.2) does the NBNS lookup for SALLY, and the next packet is actually a broadcast ARP request from the device that answers for the name SALLY to resolve BOB's IP to his MAC. Once it receives the arp reply with the MAC address, SALLY can then send the unicast NBNS "Name query response" packet back to BOB.

I guess I just want to confirm that it is a mistake in the book. It is hard to believe that a book that has gone through so many reviews, would have a mistake like this in it, so perhaps I'm misunderstanding something.

- Gonzalo

[paul1307]

Please excuse me if I missed it, but generically, the first step in this would be that Bob would send a DNS resolution request for host-name "Sally" to his designated DNS server which would have responded with the IP address for Sally. Bob then compares (using his subnet mask to determine only the network portion of their respective IP addresses) his and Sally's network addresses to determine if they're both on the same subnet (i.e. share a broadcast domain) - or not. Since they are on the same network he broadcasts an ARP Request (layer 2) for her MAC (layer 2) address, with his MAC address as the source, to which Sally sends her (unicast) reply (which contains her MAC address): communication established.

pjs

[omd]

I think the point of that section of the text is more about letting the beginner know that, before two systems can communicate at a high level, say file sharing, there are a whole lot of setup tasks and communications that must take place first, and much less about the specific sequence of events. After all, this is in the first few pages of the book and the beginning reader knows very little at this point.

What the first step is, is dependent upon a large number of variables, including what OS Bob and Sally are running, how the two machines are configured, and what communications may have previously taken place. I don't have the latest edition of the book, but in the sixth edition the text is clear that they are running Windows, and suggests that the hosts are configured such that they will attempt name resolution by broadcasting a NetBIOS name query rather than, or at least before, any other method.

I am not sure that I am in agreement with the sequence of events layed out in the book, but if the main point to be made is that there is a lot happening under the hood, then I guess I won't quibble over the specifics.

I really think this is all pretty well hashed out in the previous comments. I am responding to this post in large part because I received an email saying that someone had responded to my post, but I don't see where I have previously commented in this thread. Perhaps I tried once, but maybe my login had timed out before I clicked submit; and for whatever reasons I chose not to resubmit my comment. ???

[bricat7]

I also was a bit currious about this.

I also am currious how to repeat this with Wireshark to look at what happens.

I am on a WRT54G router and there is another computer at the house I am visiting

MyComputer
OtherComputer

I tried to open Wireshark then went and opened command prompt typed in ping OtherComputer

I hit start capture on Wireshark and then really quickly hit enter to start the ping command. I was able to capture the Othercomp information but its not really what you guys are talking about.

What is the command I use in command prompt so that I can capture in wireshark I am trying to learn what all this stuff looks like.

[sunnypalsingh]

In the Seventh Edition of the book, author has clarified it

As I already mentioned, since the two hosts are on a local LAN, Windows (Bob) will just broadcast to resolve the name Sally (the destination
192.168.0.255 is a broadcast address) and Sally will let Bob know her address is 192.168.0.3 (analyzer output not shown).