3

Will a device's arp table be updated only upon receiving a reply from a previously sent out arp request, or will it be updated if the device receives a frame/packet ?

e.g. A send a arp request to B
B send a arp reply to A
A's arp table is updated.

or

C sends a packet to A (assuming C already has A's IP/MAC in its arp table)
A's arp table did not have C's entry for some reason
A updates its arp table immediately with C's IP/MAC

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Aug 6, 2017 at 21:10

4 Answers 4

Reset to default
4

The RFC doesn't address your second scenario. The reason for this is that Host C sending to Host A may not be on the same network as Host A. Host A having an ARP cache entry in that case doesn't make sense since Host A will never look for Host C in its ARP cache. Host A will always know Host C is not on its network, so it will always look for its own gateway's entry in its ARP cache when it wants to send to Host C.

There may be implementations that do what you what you describe, but it is not addressed by the standard, and it would seem to waste ARP cache memory.

Improve this answer
2
  • What if host C is indeed in the same subnet as A ? Do you mean that A must always initiate the finding of Host C in order to update its ARP cache of C particulars ? Can't C just send something to A and A updates it ARP by itelf ?
    – Noob
    Oct 3, 2015 at 6:10
  • As I wrote, that is not part of the standard. While it is possible that some implementation does that, I doubt it is very common. Most applications contact the most devices off-net so it would not be a good use of resources.
    – Ron Maupin ♦
    Oct 3, 2015 at 6:14
3

I'll try to answer each of your questions, one after the other. But the premise is that an arp entry will get generated on a host, only when it sees an ARP response. Hosts dont typically do mac-learning from all frames. Switches do that function.

A send a arp request to B B send a arp reply to A A arp table updated.

  • The right thing to say is A does not send an arp request to B specifically. It sends out an arp request (period). This is addressed to a broadcast MAC. So everyone on the subnet (broadcast domain), including B gets it. Now B sends an arp reply. This is a very specific packet format (see RFC). And once A gets this, it will update its ARP table.

C send a packet to A (assuming C already has A's IP/MAC in its arp table) A arp table did not have C's entry due to some reason A updated its arp table immediately of C's IP/MAC

  • No. In this case, if A doesnt have C's MAC , and needs to send a response to C, it will first send out an ARP request for the IP-MAC mapping. (a.k.a a WHOIS). And this will go out to the bcast MAC. C, who sees this will respond, and this will cause A to update its mapping

All of this assumes they are on the same subnet. Otherwise, the gateway comes into picture. See Ron's answer for that.

Improve this answer
10
  • I'm not arguing with you, but this is something for you to ponder. While it is correct to say that A doesn't send the ARP request to B from the perspective of layer-2 because it is a layer-2 broadcast, A does send it to B from the perspective of layer-3 because it is addressed to B's layer-3 address. It's just one of those things for which there are different ways to look at it.
    – Ron Maupin ♦
    Oct 2, 2015 at 13:48
  • Understood. I need to take another look at a capture. I thought arp packets didnt have any IP headers, except for whats encapsulated inside the ARP tlv. For instance, it would have the eth headers, and then directly the ARP as the next layer. Would you see IP headers ?
    – ajaysdesk
    Oct 2, 2015 at 14:24
  • Sorry, I may not have been clear. You misunderstand what I'm trying to say. The layer-2 address to which the frame is sent is the broadcast address. In the ARP packet, it has the layer-3 address for the destination, asking every host in the layer-2 domain, "Is this you?" You are, of course correct, but I was just posing the other view. Like a postman who has a letter addressed to John Doe, but no street address, asking everyone on his route if the letter is for him. The letter is "addressed" to John Doe without formal addressing.
    – Ron Maupin ♦
    Oct 2, 2015 at 14:33
  • Ah I see what you mean!!
    – ajaysdesk
    Oct 2, 2015 at 14:43
  • 1
    @Noob, when A receives the frame from C, it strips off the frame to get to the packet with the layer-3 address. The ARP cache is by layer-3 address, which A now has, but A no longer has the layer-2 address. It is complex if A wants to save the layer-2 address. Most communication is with devices outside the layer-2 domain, and A has no way to know if that is the case unless it checks the ARP cache for the gateway's layer-3 address to see if the layer-2 address matches. Memory and processor resources are precious, and ARP requests are simple. It just doesn't happen the way you propose.
    – Ron Maupin ♦
    Oct 4, 2015 at 14:58
0

A diagram that explains the arp request:

Firstly,in this example, Poste1 want to send a packet to poste4, but it has not the @MAC of poste 4, so it sends a broadcast ARP. In this request, poste 1 will ask "what is the MAC address with 192.168.0.44 IP address ?" enter image description here

The poste B will answer only to Poste 1, "I am 192.168.0.44, mys @MAC is 9c-d2-1e-31-19-44" enter image description here

Finally, Poste1 updates his MAC table with the new values of poste 4. This entry will stay in this table during a period determinated by the Operating System.

Improve this answer
-2

I think you have some issues:

A send a Arp Broadcast request with destination address FF:FF:FF:FF:FF:FF, askin who has some "IP address". This request arrive to "IP address", this pc update it arp table and send a reply with it own MAC.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.