ARP & MAC learning by Routers

[ashish7aditya]

Dear Experts,

I have one doubt & need your support.

If I have a network connection as shown below:

PC-------SW#1------R1-----SW2-------Server

PC:10.1.1.1/8 ; S:11.1.1.1/8

and PC wanna ping server then how will be the PING steps followed(behind the scene),

- PC will compare the Server IP address and will conclude they are on different NW, hence will ARP for its D.GW.

- After ARP for DGW, it will learn the MAC of DGW and will forward that PING packet to router(I have skipped the point that switch is also in MAC learning phase & is updating his CAM table).

- Router will strip out L2 overheads and based on its routing table will come to that 11.0.0.0/8 NW is connected on xx i/f.

- It will forward the packet it corresponding router i/f(i/f which is connected to SW#2).

- Now again Router doesn't know where exactly Server reside on this 11.0.0.0/8 NW, so will ARP for 11.1.1.1/8 and will get the destination(Server) MAC address.

- After getting D.MAC, it will forward the packet to Server.

Up till here it is Ok.

Now for reverse path, PONG(reply to PING request from Server).

once the packet from Server reaches to Router, will router going to do the ARP again for PC or it will pre-knew this MAC of PC from previously received ping request packet?????

As anytime packet reaches the Router, L2 overheads are stripped out and while leaving the router, l2 over heads are stripped into the packet(S&D mac +VLAN if 802.3ac etc.).

Now question is, router will learn the mac first and then L2 headers will be stripped off, or

Immediatedly packet reaches the router i/f, L2 headers will be stripped off and router will not learn any mac from incoming packets.?

Best Regards!

[Richard Burts]

Your question about the response from the server seems to assume that the router has layer 2 MAC learning that is similar to what a switch does. This is not the case. So the answer to your specific question about whether the router learns the MAC from the header of the ping response the answer is no the router does not learn the MAC from the header of the ping response. So effectively the layer 2 header is stripped off and the router does not learn the MAC from the header.

When the response from the server reaches the router the router will determine from the routing table which interface it should use to forward the packet. Then the router will build the layer 2 header that it needs for the packet to be forwarded. If the router already has the MAC address of the PC in its ARP table then it just applies the MAC address and forwards the packet. If the router does not already have the MAC address in its ARP table then it will ARP for the PC MAC address.

HTH

Rick 

[ashish7aditya]

Many Thanks Ric..

So, router will not learn MAC from L2 headers.

But if any device will do the ARP for router, then Router will also update its own ARP table with that ARP request?

I mean when PC will do ARP for router, then router will also update it's ARP table with mac & IP details of PC?

And then as u mentioned if router will have mac for the PC in its ARP table, then it will use for D. MAC(pong msg) otherwise it will perform an ARP for PC.

Is this correct?

[Richard Burts · Accepted solution]

Yes you are correct. The router does not learn the MAC address from layer 2 headers. It learns MAC addresses from ARP messages. When the PC does its ARP for the router the PC learns the MAC of the router and the router can learn the MAC of the PC. So when the response from the server comes to the router then the router probably will have the MAC of the PC already in its ARP table. And if for some reason that ARP entry has been removed then the router will do an ARP request to the PC.

HTH

Rick

[Masoud Pourshabanian]

Router will update its ARP table when it receive an ARP request from the PC. You can see this behavior easily if  you debug IP ARP on th router.

It is a simple output.

1.1.1.1 is source and 1.1.1.2 is destination. The debug is on destination. Destination creates an entry as soon as it receives an ARP request.

**************

*Jan 18 10:33:31.463: IP ARP: rcvd rep src 1.1.1.1 ca01.1750.0000, dst 1.1.1.2 FastEthernet0/0
*Jan 18 10:33:31.467: IP ARP: creating entry for IP address: 1.1.1.1, hw: ca01.1750.0000

Masoud

[Masoud Pourshabanian · Accepted solution]

Hello,

When router receives ARP request from PC, it updates its ARP table with the IP and MAC of the PC by looking at ARP request.

Server does the same when it receives ARP request from router so when replying, neither server nor router needs to send ARP request.

The reason is PC includes its own IP address and MAC address in the ARP packet and router checks the ARP packet and completes its ARP table.

Please check the link below to see the format of ARP packet. As you see sender hardware address and protocol address are included.

http://image.slidesharecdn.com/arpaddressresolutionprotocol-110519232546-phpapp01/95/arp-address-resolution-protocol-6-728.jpg?cb=1305847611

Hope it helps,

Masoud