Consider 2 PCs 01 and 02, where 01 is connected to a router R, which is in turn connected to a switch S, connected to 02:
01--R--S--02
I need to understand what would happen to the ARP cache of 02 if it were pinged by PC 01, and then by switch S.
I'm confused on this and would really appreciate any help I could get.
ARP stores the mapping between IP addresses and their respective MAC addresses.
Since you mention that your switch can ping, I'm going to assume that you mean it's a Layer 3 switch and not a pure Layer 2 switch.
Assuming the setup is as below:
PC1 (.1) --- R1 (.2) --- S1 (.3) ---- (.4) PC2
[Network: 10.10.10.0/24]
[I'm assuming 10.10.10.2 and 10.10.10.3 in R1 and S1 respectively are SVIs and the links in R1 and S1 are all switch-ports]
Pinging from PC1 to PC2 will make an ARP entry in PC2 as: 10.10.10.1 --- PC1
Pinging from S1 to PC2 will make an ARP entry in PC2 as: 10.10.10.3 --- S1
I think your confusion can be cleared by the fact that when you are pinging from PC1 to PC2, the packet is bridged through R1 and S1 to PC2 without any of the headers being changed, (i.e.) the source MAC address is still going to be PC1.
Now let's assume PC1 and PC2 are in different subnets.
PC1(10.10.10.1) --- (10.10.10.2) R1 (20.20.20.1) --- S1 (20.20.20.2) ---- (20.20.20.3) PC2
[Again here I'm assuming 20.20.20.2 to be a SVI and the links in S1 to be switch-ports]
When you are pinging from PC1 to PC2 and assuming that the default gateway R1 has been set for PC1, then the ping packet will be sent to R1, who will then route it towards the correct network (20.20.20.0/24 in this case).
So pinging from PC1 to PC2 will make an ARP entry in PC2 as: 20.20.20.1 --- R1
Pinging from S1 to PC2 will make an ARP entry in PC2 as: 20.20.20.2 --- S1
First thing about your network design is that there are two different subnets in other words there are two different networks. Router connects these networks. In order to answer your question, we should understand how actually router and switch works and what they do in network. In short;
--> Router uses ip adresses to achieve its mission which is connecting networks with each other.
--> Switch uses mac addresses to achieve its mission which is connecting hosts and devices in the same network.
Two network means two different ip subnets. In your question, 01 and 02 must have different network IDs if you don't use IP tunneling.
Let's say, Network ID of 01 is 192.168.1.0/24 and its ip adress from this block is 192.168.1.4. Network ID of 02 is 172.16.0.0/16 and its ip adress from this block is 172.16.1.3. In addition to them, router's ip adress for first interface that belongs 192.168.1.0/24 is 192.168.1.1 and for other interface that belongs 172.16.0.0/16 is 172.16.1.1.
When you ping from 01 to 02 like ping 172.16.1.3, router will forward your ICMP packet to other side by changing frame fields. This is really important! Router will change source mac adress field from mac adress of 01 to its mac adress that belongs its interface that belongs 172.16.0.0/16 networks. Then router will instert mac adress of 02 to the destination mac adress field.
How router knows mac adress of 02? The answer is that ARP table in router. Router looks its ARP table to find mac adress of 172.16.1.3. After these operations, there is a new packet that generated from router. There is no mac adress of 01 in this new packet so 02 will never know mac adress of 01. Ultimately, there will be no entry in 02's ARP table about 01.
But there will be entry about Router interface's mac adress that belongs 172.16.0.0/16 network..
For the sake of example,
ARP TABLE OF 02;
IP adress --> Mac adress of is 172.16.1.1 -- xx:xx:xx:xx:xx:xx
ARP resolves a layer-3 address to a layer-2 address when a device sends something to another device. Because it is trying to resolve a layer-2 address, it only operates on the layer-2 LAN, not across a layer-3 device, e.g. router.
If R doesn't have an entry in its ARP table for 02, R will send an ARP request for the layer-2 address of 02, and the ARP tables of both devices will be updated with the layer-2 address of the other device, otherwise R will simply send the ICMP echo request to 02.
When 02 replies to 01, if it doesn't have an entry for R in its ARP table, then it will send an ARP request to R, and the ARP tables of both devices will be updated with the layer-2 address of the other device, otherwise 02 will simply send the ICMP echo reply to 01.
Layer-2 switches are normally transparent devices, and as such, they play no part in the ARP tables of the layer-3 devices, unless S is a managed switch with a management layer-3 address in the same layer-3 network as 02, then pinging 02 from S, if S doesn't have an entry in its ARP table for 02, S will send an ARP request for the layer-2 address of 02, and the ARP tables of both devices will be updated with the layer-2 address of the other device, otherwise S will simply send the ICMP echo request to 02.
When 02 replies to the management interface of S, if it doesn't have an entry for for the management interface of S in its ARP table, then it will send an ARP request to for the management interface of S and update its ARP table with the layer-2 address for the management interface of S.
If the management interface of S is in a different network, then the result will be the same as if 01 pinged 02: it is possible that the ARP tables of R and 02 get updated.
In any case, the switch will look at any frame entering the switch, and it will update its MAC address table based on the source layer-2 address of the frame. It will then look in its MAC address table for the destination MAC address to see if it has an entry. If no destination layer-2 address entry is found, it will flood the frame to all the other switch interfaces. If the layer-2 destination address is found in the MAC address table, then the frame is sent to the interface indicated by the MAC address table.
The arp table of any layer 3 device will have mac addresses of its immediate neighbors i.e next hops since mac address is updated in frame when its forwarded by routers.
So PC 02 and PC 01 will not have each other's mac address entry in their arp table. They will have router's
