A question about ARP request?

casinamul · ‎07-05-2012

Does a device refer to its ARP table to send ARP reply when it get ARP request?

Sent from Cisco Technical Support Android App

Ganesh Hariharan · ‎07-05-2012

casinamul wrote:

Does a device refer to its ARP table to send ARP reply when it get ARP request?

Sent from Cisco Technical Support Android App

Hello ,

ARP is the address resolution protocol for IP

Before you can send an IP packet, you need to built a frame destination ethernet address,If you don't know what the destination MAC address is, you use ARP to get it

You broadcast a packet at layer 2 asking who has a certain IP, and what MAC address it belongs to

The owner of the IP (if present) sends back a unicast packet to you with the answer (this means only you get the result of that arp query) You broadcast a packet at layer 2 asking who has a certain IP, and what MAC address it belongs to
The owner of the IP (if present) sends back a unicast packet to you with the answer (this means only you get the result of that arp query)

Hope it helps

Regards

Ganeshh Iyer

Rate if it Helps...

Hari Haran S M · ‎07-05-2012

No, the device doesn't look into it's ARP table to reply for a ARP request. Any device will respond to a ARP request only when that device has that IP and all other ARP request will be dropped.

casinamul · ‎07-05-2012

Iyer,

Thanks for your kind answer.

I understand what you explained. However, I am wondering if ARP does not refer to its ARP tables added by ARP request when sending ARP reply.

Sent from Cisco Technical Support Android App

Ganesh Hariharan · ‎07-05-2012

casinamul wrote:

Iyer,

Thanks for your kind answer.

I understand what you explained. However, I am wondering if ARP does not refer to its ARP tables added by ARP request when sending ARP reply.

Sent from Cisco Technical Support Android App

Hello,

I hope the below explanation would answers your query

The ARP table is maintained dynamically. There are two ways that a device can gather MAC addresses. One way is to monitor the traffic that occurs on the local network segment. As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs.

Another way a device can get an address pair is to broadcast an ARP request. ARP sends a Layer 2 broadcast to all devices on the Ethernet LAN. The frame contains an ARP request packet with the IP address of the destination host. The node receiving the frame that identifies the IP address as its own responds by sending an ARP reply packet back to the sender as a unicast frame. This response is then used to make a new entry in the ARP table.

Let me know if you require more informations...:)

Regards

Ganeshh Iyer

Rate if it Helps ...

Mullerjr thomas · ‎07-05-2012

Nice Explanation Ganeshh

Akshay Balaganur · ‎07-06-2012

"The ARP table is maintained dynamically. There are two ways that a device can gather MAC addresses. One way is to monitor the traffic that occurs on the local network segment. As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs. "

#Gentle Correction:

No device learns IP and Mac Binding from the flow through ARP traffic. You always have send a ARP request to learn/build a new/expired ARP enry.

ARP RFC

http://tools.ietf.org/html/rfc826

Cheers,

AB

Ganesh Hariharan · ‎07-09-2012

Akshay Balaganur wrote:

"The ARP table is maintained dynamically. There are two ways that a device can gather MAC addresses. One way is to monitor the traffic that occurs on the local network segment. As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs. "

#Gentle Correction:

No device learns IP and Mac Binding from the flow through ARP traffic. You always have send a ARP request to learn/build a new/expired ARP enry.

ARP RFC

http://tools.ietf.org/html/rfc826

Cheers,

AB

Thanks AB for the RFC ....:)

Cheers

Ganesh

Vivek V · ‎07-06-2012

Hi Ganesh,

Hope you are doing well.

You have mentioned that : "

As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs. "

Hence my doubt , what will it record if the device that is transmitting does not have an ip address and is requesting one via dhcp ?

Regards,

Vivek

casinamul · ‎07-08-2012

Thanks for all the replies.

However, actually I wannted to know that when ARP request/reply packet is encapsulated, how it happen and what is reffered to.

For IP packet, ARP table is reffered to look up the IP packet's destination MAC address to encapsulate the IP packet into Ethernet frame.

I know ARP is a protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks, but I am just wondering if ARP request/reply itself also refer its ARP table as ARP looks protocal for Later 3, network layer.

Say, there are Host A, Host B and SW1 on the same local network, and let me explain ARP process untill the Host B sends ARP reply to Host A.

Host A

1. Host A ping Host B

2. Ping process creates an ICMP Echo Request and IP packet is made by the Echo Request.

3. Destination IP of the IP packet is in the same subnet, and is a unicast IP packet.

4. ARP process on the Host A looks up the IP packet's destination MAC address from its ARP table to encapsulate the IP packet into Ethernet frame, but it is not in the ARP table. So the ARP process try to send ARP request after buffering the IP packet.

5. ARP process creates ARP requet.

6. The host A encapsulate the ARP request packet into Ethernet frame with FFFF.FFFF.FFFF for its destination MAC address.

7. The Host A sends out the Ethernet frame .

SW1

8. The SW1 recieves the ethernet frame.

9. The frame's source MAC address does not exist in the SW1's MAC table, so the SW1 adds the MAC address to its MAC table.

10. The SW1 sends out the frame to all ports in the same VLAN except the receiving port as the frame's MAC address is FFFF.FFFF.FFFF.

Host B

11. The host 2 recieves the frame and decapsulates it.

12. The decapsulated frame is ARP request packet, so the ARP process on Host B processes it.

13. The Host B determines that the destination IP address in the ARP request packet matches its own IP address, and adds the IP to its own ARP table.

14. The Host B creates ARP reply packet.

15. The Host B encapsulates the ARP reply packet into Ethernet frame.

16. The Host B sends out the Ethernet frame.

So again, what I want to know are between item number 5 and 6, 15 and 16.

Hari Haran S M · ‎07-09-2012

Hi Casinamul,

Between 5 and 6, 15 and 16, nothing will happen. The ARP table is referred when I don't have the L2 address [MAC address] while sending out a packet. For the ARP packet, the source MAC is available and the destination MAC is all F's. Hence, the PC will not look into the ARP table.

In point 13, the host B will not add the IP/MAC into it's own table while replying to the ARP request. The Host B has to ARP for Host A to get the IP/MAC in the ARP table.

Does this answers your question?

Regards,

Hari

manish arora · ‎07-09-2012

From a system's (Unix based) point of view, between 5 and 6 or between 15 and 16 , the system will make use of arp modules or networking modules so as to reply with the configured ( static or dhcp) ip address / interface hardware address combination. I am not sure about the exact module used by Redhat but some research can lead you to the module which doesn't use the local ARP table BTW. I think the module uses information contained in the interface configuration files.

Thank you

Manish

casinamul · ‎07-10-2012

Hi Manish,

Thanks a lot for you answer.

Sent from Cisco Technical Support iPad App

casinamul · ‎07-10-2012

Hi Hari,

Sorry for my late reply.

About the destination MAC in ARP request packet it must be 0000.0000.0000, not FFFF.FFFF.FFFF which is going to be added to ethernet frame.

And about when host B receive ARP request the host B update its ARP table reffering to the ARP request. You can either test this using Cisco packet tracer or find the following URL.

http://technet.microsoft.com/en-gb/library/cc758357%28v=ws.10%29

Thanks a lot for your help.

Sent from Cisco Technical Support iPad App

technet.microsoft.com/en-gb/library/cc758357%28v=ws.10%29

Hari Haran S M · ‎07-10-2012

Hi Casinamul,

You are indeed right about the destination MAC. It shold be all zero's and the ethernet frame will have all F's as destination.

I went through the link and it doesn't seems to be right. I just tried myself. Follow the steps, to check this,

Connect 2 latops using a cable. Let's call them host A and host B
Assign IP address to them in the same subnet
Make sure that the ARP cache is not there in the machines [use the command arp -a in command prompt of the machine]
Run a packet capture on host B
Now ping the host B IP from host A
In the packet capture you will see host B sends ARP request for host A before replying for the ping

Regards,

Hari