Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I'm a beginner in networking and I'm looking for answers for these questions:
Answer to first question:
In a LAN if the source and destination are part of the same subnet or broadcast domain then they do not need to pass through gateway. They can reach each other directly (typically in a bus topology). If any network device comes in between its a switch. A gateway comes into picture when you need to reach a host machine that is part of different LAN segment or both having different broadcast domain.
To determine whether two hosts are part of same network, two IP addresses are AND'd with a subnet mask if the result is the same then they are on the same network.
Answer to your second question:
The target mac address in the arp packet is by default set to zero and is ignored according to RFC 5227. The destination mac address in L2 header is correctly set to ff:ff:ff:ff:ff:ff for broadcast arp request.
Assuming your are talking about a common TCP/IP over Ethernet network.
1 - this is not the case, if the destination is on the same network, the connection is made directly to the destinaiton without involving the gateway
2 - ARP is defined by RFC826 in which it is stated:
ar$tha: Hardware address of target of this packet (if known). [...]
If it does not (find the address in the cache) it generates an Ethernet packet with a type field of ether_type$ADDRESS_RESOLUTION. [...] It does not set ar$tha to anything in particular, because it is this value that it is trying to determine. It could set ar$tha to the broadcast address for the hardware (all ones in the case of the 10Mbit Ethernet) if that makes it convenient for some aspect of the implementation. It then causes this packet to be broadcast to all stations on the Ethernet cable originally determined by the routing mechanism.
Since the RFC doesn't specify the destination address, it's up to the implementation to set at whichever value. Some Operating Systems (Solaris I think) use all-zero while others use all-one (broadcast) address.
When a device sends a network request, on the LAN (same subnet) and the L2 switch does not have an ARP for that host, it will send broadcast out all interfaces (minus the one traffic was received on) the .Pcap looks like "who is x.x.x.x tell x.x.x.x" the device with the associated MAC address will respond. The ARP is then saved in the MAC table of the L2 switch should additional traffic needs to return to that destination.
If you can imagine a hill, host are at the bottom and can only see each other, the gateway stands at the highest point and sees other gateways that are telling each other "hey I know this network x.x.x.x /24". Since the host don't know of other networks it sends to the gateway to forward.
