2

Assume a host is connected to a router. If a host pings an unknown unicast address that's not in host's routing table, which one of the following is going to happen? (Assume the default route points to router interface)

  1. Host will send ping requests to Default Gateway?
  2. Host will attempt to resolve Unknown Unicast IP-to-MAC by sending ARP broadcast?
  3. Anything else?

I tried this on my laptop running Wireshark on wireless NIC and display filters on ARP or ICMP. There's neither ARP request/flood or ping request going out of laptop. Ping fails with "Request timed out" message.

I hope someone can help me understand the behavior.

Improve this question

1 Answer 1

Reset to default
4

Every time a hosts needs to send a layer-3 packet on a layer-2 LAN, it must resolve the layer-3 address to a layer-2 address in order to be able to build the layer-2 frame to encapsulate the layer-3 packet. That is what ARP (Address Resolution Protocol) does.

A host will first determine if the destination address is in the same network as the host itself. If it is, then it will look in its ARP table to see if it already has the resolution. ARP tables begin empty, and ARP table entries time out, except for statically defined resolutions. If it finds the entry in its ARP table, then it has the layer-2 address to use to build a frame.

If the layer-3 address is not in the ARP table, the host will send an ARP request to find the layer-2 address. If the target does not respond in a certain time period, the layer-3 packet will be dropped, and an ICMP message saying the host could not be found will be sent to the application.

If the destination layer-3 address is on a different network, the host will use the above procedure to get the layer-2 address of its configured gateway. Most likely, the host already has the layer-3 address and layer-2 resolution in its ARP table, so it doesn't need to send an ARP request, but it will if the entry has timed out.

Improve this answer
4
  • 1
    That has to do with the ping application. Ping uses ICMP echo, which is often blocked somewhere in the path. The application didn't receive an ICMP echo reply in the time period, so it reports that it timed out. That has nothing to do with ARP. If the host could not resolve an address, you would get something like host unreachable. If the router doesn't know how to get to the destination network, it will send something like network unreachable.
    – Ron Maupin ♦
    Jul 28, 2017 at 17:33
  • See my reply to your original, deleted comment.
    – Ron Maupin ♦
    Jul 28, 2017 at 17:35
  • Sorry, I deleted my comment for which @Ron Maupin provided response above. Here's my comment: What's the reason for ping failing with "Request timed out".
    – Bhaskar
    Jul 28, 2017 at 17:35
  • See my replies to your deleted comments.
    – Ron Maupin ♦
    Jul 28, 2017 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.