Please help me understand this simple arp request / reply - how does a router know an IP address without knowing the MAC address?

Question

I am new to networking, I am using Wireshark on my home PC to learn about ARP. I understand that ARP is used to build the ARP cache, which correlates IP addresses to MAC addresses on a LAN. ARP messages are L2.

I saw the following two frames.

 [ ARP Request ] - who has 192.168.1.66 - Tell 192.168.1.254 [GW]

    - Eth: 
            Destination: Micro-St_6d:ea:0c [BOB'S PC]    
            Source: Sagemcom_0c:6b:29   [GW]

My understanding: Arp request from my Default Gateways MAC asking "Reply with your MAC if you have Bob's IP."

[ ARP Response] - 192.168.1.66 is at 4C-CC-6A-6D-EA-0C

    - Eth:  
           Destination: Sagemcom_0c:6b:29 [GW]
           Source: Micro-St_6d:ea:0c    [BOB'S PC]

My understanding: ARP response from Bob's PC saying "this IP is me - here is my MAC"

My questions:

1. Why is the destination field in in the arp request directly to Bob's PC? How did it know this was the correct destination? And why is it asking if it seems to know? A broadcast would have a destination of all F's right?
2. More generally to ARP: How does the Default Gateway get to a position where it knows an IP, but doesn't know a MAC? I understand they operate on different layers, but wouldn't it have needed L2 to pass on that information at some point?

Answer 1

Why is the destination field in in the arp request directly to Bob's PC? How did it know this was the correct destination? And why is it asking if it seems to know? A broadcast would have a destination of all F's right?

Right. So it already knew and was just confirming that it was still the case. You don't want to cache ARP entries forever because networks can change. But there's no reason to use a broadcast and disturb every computer in the network when you're 99.9% sure which computer you want to talk to.

More generally to ARP: How does the Default Gateway get to a position where it knows an IP, but doesn't know a MAC? I understand they operate on different layers, but wouldn't it have needed L2 to pass on that information at some point?

Consider a typical SoHo router set to forward port 8000 to 192.168.1.7 -- when it gets an inbound packet from the WAN sent to port 8000, it needs to rewrite the destination IP address to 192.168.1.7 and send the packet on to the machine with that IP address. How should it know what MAC destination address to use?

That's about the only case for a typical SoHo router because other than port forwarding (and a few other rare edge cases such as a DNS or NTP server being local), they don't initiate communication with LAN devices that haven't talked to them. Nevertheless, they will still confirm the IP to MAC mapping periodically.

Answer 2

Not all data-link (layer-2) protocols use MAC addresses, and of those that do, some use 48-bit and some use 64-bit MAC addresses. It is the IEEE LAN protocols that use MAC addresses, and many WAN protocols do not (some use no addressing and other use different addressing).

Routers strip off the layer-2 frame that contains the layer-2 (MAC) addresses to get to the layer-3 packet. The router then forwards the packet based on the layer-3 (IP) destination address, building a new frame for the next interface, using the protocol for the next interface. If the next interface protocol is something like PPP, then the new frame will not have a layer-2 address, if the next interface protocol is something like frame relay or ATM, it will use the addressing for that protocol for the layer-2 frame, or if the next interface protocol is an IEEE LAN protocol, the router will build a frame with the MAC addressing of the next interface protocol.