How do computers read FFFFF Mac adress and respond to a switch?

[golasinjo]

I'm really confused and I'm hoping that someone is gonna clarify this for me.

let's say we have 3 pc connected to a switch :

Pc1 then sw1{switch1} and the other two pcs pc2 pc3.If pc1 wants to send an Arp packet (Arp-request) and it has the source ip and Mac address and it has destination ip address but FFFFFFFFF mac address.How does the other devices respond to it when the address is FFFFF It is not like unicast or frame flooding where it searches the corresponding Mac address and forwards the frame if it's in the mac address table,or floods the frame until one of devices respond with corresponding Mac address.How does it pc2 respond when the mac address is FFFF.How does it read the FFFFFFFFF and say I yeah that's my mac address?Please help me to understand this.

[Martin L]

You are correct; Arp-request has both IP info and source MAC but needs destination MAC to match its destination IP address.  the all FFFFFFFFF mac address is placed in the Ethernet frame filed. Ethernet is L2 frame and has only and needs only MAC info.  On top of that L2 Ethernet frame,  there is ARP part of packet with L2 and L3 info.  Here, we have source MAC and IP info but destination MAC is actually all 0s. Field call Target MAC (unknown) and Target IP (known).  ARP packet is asking Who has IP of X, what is your MAC? I'm IP Y1 and my MAC is y2.

While ARP is marked as L2 frame, I could call it as L2 and half packet;

next, once you get all info, you can build L3 and above packets but still those will ride on L3 Ethernet frame (sit on top of L2 frame).  i.e. ICMP sits on Ethernet II, EIGRP info sits on top of Ethernet II, etc

Regards, ML
**Please Rate All Helpful Responses **

[golasinjo]

Martin you are so helpful can you just clearify this to me.Because I have A bad habit to question everything.So  Arp sits on top of the layer two and has layer two and layer 3 info.

So let me get this straight 

Arp is only translating ip address to mac adress it's 32 bit to 64 bit translation it maps the ip to mac adress. If I wants to send a frame to pc 3 from pc 1 via switch if it has the mac adress in the Arp table it will unicast a frame to switch then switch will forward the frame to pc 3  if it's in mac adress table if it isn't it will flood the frame to all pcs and only corresponding pc with mac adress will receive the frame   If the mac adress isn't in Arp table its gonna broad cast it switch will see ffffff in enthernet frame and pass is back to other pc wich will Arp reply with it's mine ip address and here is my mac adress then it will unicast it back to Arp and then the frame will be sent with unicast known or uknown frame depends how long it holds  the mac address in it's Mac adress table .Please sry if I ask stupid question.Im gonna be frank and say it's my 3 day learning networking and I want to know all of it.I can't proceed if the matter isn't clear to me .Once again thank you martin for taking your time 

[Martin L · Accepted solution]

Forget about that 32-bit to 64-bit mapping for now; I think you are talking about M-cast mappings.  Switch has ARP table but here for your scenario MAC address table is used (one that has MAC to vlan to port mappings). Switch ARP is used if switch needs to communicate with anyone via IP.  B-cast and M-cast frames are checked and forwarded based on MAC table. Any frame with FFFFs in destination will be flooded out by switch.  Any unicast unknown frame to switch will be also flooded out by that switch.  (a unicast unknown is just not in mac table at that switch at this time). 

If PC1 in vlan 2 pings PC3 also in vlan 2 and ARP table is empty, ARP packet will go first before ICMP one. PC1 creates ARP frame asking whoever has IP X, what is your MAC?  PC1 builds l2 frame with FFFs and ARP packet with Target MAC/IP.  Frame go out to switch who multiplies (copies) that ARP frame into several ones and sends out of all ports in the vlan 2 (but not sending frame out of incoming port).  So, all PCs in vlan 2 get ARP from PC1. Only PC 3 has "target" IP so only PC 3 will reply with ARP reply saying my MAC is x. Note: If switch has IP interface UP, it will check ARP frame just in case it is for that switch.

Next time PC1 pings 3 it has all info so there is no ARP frame sent, only ICMP one. ICMP packet includes L2 Ethernet frame with all info it needs. Switch checks L2 Ethernet frame MAC addresses. Records source MAC into its MAC table; and If the destination MAC is in the table, forwards frame based on MAC table stored info. If destination MAC is not in table, switch copies frame and sends them out (multiple copies of ICMP are going out).  

To sum up; switch may make copies of a packet based on its MAC table but all B-cast and M-cast frames /packets are multiplied automatically and send out of all ports in the vlan x and trunking ports as well (there are few restrictions).

For exam purpose ARP is L2 frame but has both MACs and IP address fields.  When using Ethernet cables, any packet needs Ethernet info and Ethernet frame i created.

Regards, ML
**Please Rate All Helpful Responses **

[Richard Burts]

Let me first respond to this statement "Arp is only translating ip address to mac adress". Perhaps it is my tendency to be very careful about terminology but I do not agree with the idea that arp is translating addresses. More appropriate to say that arp is associating ip address and mac address, or that arp is mapping ip address to mac address.

Then let me attempt a different answer to the original question. In arp messages there are 4 significant fields: source IP, source mac, destination IP, destination mac. In an arp request 3 of the 4 are knows (source IP, source mac, destination IP). In the arp request the destination mac is set to the ffff broadcast address. This means that every device in this broadcast domain (the broadcast domain is the vlan/subnet) will receive the arp request. Most of the devices will receive the request, recognize that it does not apply to them, and will not do anything in response. If a device in the vlan/subnet receives the arp request and its IP does match the IP of the request then that device will respond. The response is unicast to the requester. In the response the destination mac is the mac of the original requester and the source mac is the mac of the device that is responding.

[golasinjo]

Thank you Richard for the input.You are right Arp is mapping addresses not translating.It maps the mac adress to ip address.My mistake,and this community is so hepfull.God bless you all.

---

[Richard Burts]

You are welcome. I am glad that our explanations have been helpful. On the surface mapping and translating might seem similar but when you look at what they are really doing they are quite different. Glad that we have clarified that.

[golasinjo]

Martin thank you for clerification.Now I understand it perfectly.I was confused i thought l2 is separate from Arp.I was confused about data decapsulation,I thought I builds from layer 1 than 2 than 3.My mistake was thinking Arp is above layer two and separated from it .It is above but it's still is part of layer two Like you said layer two and half.You cleared it perfectly.Such a clear and precise explanation.Have a good one