Consider the following scenario:

Host B has IP and host A has IP and they are connected to a Layer 3 managed switch having IP on a particular broadcast domain (lets say VLAN 10)

Theory 1 (which I believe to be false)

When B initially tries to ping It will send an ARP request to FF:FF:FF:FF:FF:FF asking who has and the switch will only flood this request on all ports in the VLAN, if and only if it doesn't have an ARP entry in its own ARP table showing the entry for If it has such an entry it won't even forward the ARP request to Host A and will reply with the MAC address for from its own ARP cache with the MAC address of A.

Theory 2 (Which I believe to be correct).

The switch will not intervene in the ARP process even if it has an ARP entry for the IP being queried for. If B (or any other host in this broadcast domain) sends an ARP request for to FF:FF:FF:FF:FF:FF the switch will just broadcast it to the domain and let host A respond for itself to this ARP request. This will happen even if the switch as an ARP entry for A ( in its own ARP table. The switches own ARP table is only for its own communication (from its IP with the hosts in the VLAN, and it doesn't act like a caching ARP proxy as stipulated in Theory 1.

Which of the above scenarios is accurate? Do some switches actually behave in the manner described in Theory 1?


The switch, while a layer-3 switch, is only a layer-2 switch for a LAN. As a layer-2 switch, the switch doesn't get involved with the ARP request/reply, unless it is the target of the ARP request, or it is making the ARP request. Of note is that the SVI address of the layer-3 switch is just another host on the LAN, and it will update its layer-3 ARP cache when it sees the ARP request, but it will not actually interpose itself in the process between the two hosts.

The switch will also update its MAC address table for the LAN with any frame coming into any of its layer-2 interfaces.

| improve this answer | |
  • Makes sense. Thanks for confirming. This basically means Theory 2 is correct. – Fahad Yousuf Jun 17 '16 at 19:56

"theory 2" is how switches normally operate.

"theory 1" would be an optimisation hack. I know the BGP EVPN guys are doing local arp/nd interception to reduce BUM traffic. I have no idea if anyone is doing it in a plain Ethernet environment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.