Should I receive an ARP reply from a host that is logically on a different subnet but is connected to my host via a hub?

Question

Host A: 128.238.66.100/16
Host B: 128.238.67.100/24

The hosts are connected to the same hub and nothing else is connected to that hub. The routing and ARP tables of both hosts are empty.

Host A attempts to ping Host B. Since Host A believes that Host B is in the same subnet, whether that should be relevant or not, I see an ARP Request going out. On the other hand, Host B never replies back with an ARP Reply.

Before proceeding, please check this figure.

Question 1: Would Host A produce an ARP Request if its IP address was 128.238.66.100/24? According to my knowledge the answer is no, since ICMP is above IP therefore the comparison of whether Host B belongs on the same subnet or not would happen before Host A determines whether he needs to produce an ARP Request or not, and since the routing table is empty the packet would be dropped.

Question 2: Should Host B send back an ARP Reply? Since ARP is below IP, no subnet comparison should take place and the host should immediately reply back, right?

Answer 1

HostA would send an ARP looking for a target address of 128.238.67.100.
HostB would receive the ARP request
Whether HostB responds or not is a matter of how the client is configured.*(see below)

Either way, even if HostB responds, communication would fail because when HostA sends the ICMP Echo to HostB, HostB will get it, but from HostB's perspective, HostA's address is on a foreign network, so HostB will try to send the response to a default gateway. If none are configured, the packet would simply be dropped.

I wrote a bit about how ARP and Switches work in this post. Might be useful to help drive the concept home.

---

*An ARP Response is not sent to a destination IP. It is sent to a destination MAC. An ARP Request contains the "Sender IP" and "Sender MAC". So technically, HostB, upon receiving the ARP Request, has everything it needs to build a proper ARP Response. The "Additional configuration" lies in whether or not the HostB's operating system chooses to also validate whether the "Sender IP" from the ARP Request is on its own network. If it doesn't do this check, the ARP Response will be sent. If it does, the ARP Response will not be sent.

I just labbed it out in GNS3 using two Routers as HostA and HostB. Using "debug arp", this is the console message I received from "HostB":

*Mar  1 00:12:14.595: IP ARP req filtered src 128.238.67.100 c202.28dc.0000, dst 128.238.66.100 0000.0000.0000 wrong cable, interface FastEthernet0/0

So it appears, according to Cisco IOS, that the additional verification that the Sender IP is within the receiver's network does happen, and as such, the ARP Response is not sent. I verified it with a packet capture as well, and only saw the ARP Request, not the ARP Response.

This is the 'additional configuration' I was referring to above. Whether all OS's operate this way, I'm afraid I can't know for certain, you would have to test them out individually.

Answer 2

Host A thinks Host B is "local" because it's within the /16 netmask. Host B would normally answer it unless someone went overboard on "security". However, given the smaller netmask (putting A "off net"), B would never attempt to contact A directly. Once A and B no longer overlap, neither will look for the other locally, but will route any traffic (if possible) through other node(s).

(ARP and ICMP are different protocols entirely.)

Answer 3

Before i explain this you should understand how ARP packet is send. Anding process happens before sending the ARP packet out(S.IP+ Source subnet mask) and D.IP+ Source subnet mask) If we get a same value for both the anding values then the host sends the ARP to destination, if the Anding value is different it sends it to Gateway. Host A anding value would be same hence it would have forwarded the request to HOST B but when HOST B needs to response it does ANDing process and the value would be different hence it does not respond to HOSTA

Answer 4

When using a repeater hub, all network frames are physically received by all nodes. The question is whether those ARP requests are actually sent.

Question 1: Would Host A produce an ARP Request if its IP address was 128.238.66.100/24?

No. 128.238.67.100 is outside the local 128.238.66.0/24, so a router would be required. Absent a route to 128.238.66.0/24, the packet is dropped. ARP is only attempted for a destination address that is considered local.

Question 2: Should Host B send back an ARP Reply? Since ARP is below IP, no subnet comparison should take place and the host should immediately reply back, right?

Host B uses the same local routing decision that Host A is using: "Is the destination local to me (=located within my subnet)? If yes, ARP destination IP and send via destination MAC. If not, determine router, ARP router IP and send via router MAC".

Since the reply-to address 128.238.66.100 is outside the local 128.238.67.0/24 it requires a route. Absent that route, the packet can only be dropped.

The ping can only be successful when both hosts use a /23 network mask (at most), making them both part of the same subnet.