Mac Learning in Cisco Box and ping

[Vishnu Vardhan S]

Hey all!!

Have you ever thought how a sends out a packet to the router when both the router configured with same ip address. 

R1-12.0.0.1-----------SW1-------------R2 12.0.0.2

                                          |_____________R3 12.0.0.2

I checked and found it to be working normal with this. 

Actually, the switch is storing the latest mac information and the R1s arp table is getting update with the right path. 

The ping will go only to R2 if we flap R2 the latest mac gets resolved. 

[Andrew Khalil]

@Vishnu Vardhan S,

Greetings,

Actually it depends, if R3 sends traffic first so the ping from R1 to 12.0.0.2 will go to R3 not R2.

But if it didn't send traffic never while R2 is connected to a lower interface id (like f0/2 is lower than f0/3) so it will reply for the ARP first and then the ping goes to the R2 all time instead of R3.

Please don't forget to rate helpful responses and mark solutions!

Bst Rgds,

Andrew Khalil

[Vishnu Vardhan S]

If you mean to say apart from the fact of CAM table update in the switch takes the latest one meaning if my ping is going to R3 and if i shut the R3 so the ping will be diverted to R2 and my R3 comes back so again R3 will cont to get ping request. 

I would be happy if you could explain how the interface number is impacting this ICMP packet, I mean how they are related. 

[Andrew Khalil]

@Vishnu Vardhan S, Greetings,

They are not related ))) and it's not what I meant!  

but let me explain it in a chronological sequence!

Let's imagine that we are creating (just now) a lab contains 3 routers and 1 switch,

when we connect the 3 routers (int g0/0) to the switch (int f0/1, f0/2, f0/3), there is nothing in the mac-address table of the switch, as by default the routers interfaces are still down and none of the routers sent anything to the switch yet!

Once you issue #no shutdown, for the int g0/0 of R1, R2 and R3, and then go to the switch and issue #show mac address-table, you shouldn't find any mac addresses! 

Once you ping from R1 which for example has the IP add 10.1.1.1 to the IP 10.1.1.2 (this IP address is given to R2 and R3) so, the router send ARP packet to resolve the mac add of the device that has this IP (at this moment the mac address of R1 is recorded in the mac address table of the switch corresponding to the int f0/1 ) and the switch floods this messages to all its ports, the one who answers first, will be considered the active one (and usually f0/2 will answers before f0/3 because it gets the packets first).

That's why R2 will reply for the ICMP while R3 not!

The most interesting that if you shutdown R2, and ping again from R1, R3 will not reply, as R1 knows the mac address that represent the IP address 10.1.1.2, to make it replying, you can ping 10.1.1.1 from R3, by this way R1 will learn that the mac address of R3 is representing 10.1.1.2 and next time you ping from R1, R3 will reply!

I hope it's clear, you can test it using real devices or packet tracer, I prefer packet tracer to see the packets during the process and to filter what packets you would like to monitor! 

Please don't forget to RATE any helpful responses and MARK solutions!

Bst Rgds,

Andrew Khalil 

[Vishnu Vardhan S]

awesome man, now I got the whole concept. Thanks for the elaborated answer.

[Andrew Khalil]

@Vishnu Vardhan S

Happy to help dear! 

Please don't forget to mark solutions! 

Bst Rgds,

Andrew Khalil