I am new to networking, I am using Wireshark on my home PC to learn about ARP. I understand that ARP is used to build the ARP cache, which correlates IP addresses to MAC addresses on a LAN. ARP messages are L2.
I saw the following two frames.
[ ARP Request ] - who has 192.168.1.66 - Tell 192.168.1.254 [GW] - Eth: Destination: Micro-St_6d:ea:0c [BOB'S PC] Source: Sagemcom_0c:6b:29 [GW]
My understanding: Arp request from my Default Gateways MAC asking "Reply with your MAC if you have Bob's IP."
[ ARP Response] - 192.168.1.66 is at 4C-CC-6A-6D-EA-0C - Eth: Destination: Sagemcom_0c:6b:29 [GW] Source: Micro-St_6d:ea:0c [BOB'S PC]
My understanding: ARP response from Bob's PC saying "this IP is me - here is my MAC"
- Why is the destination field in in the arp request directly to Bob's PC? How did it know this was the correct destination? And why is it asking if it seems to know? A broadcast would have a destination of all F's right?
- More generally to ARP: How does the Default Gateway get to a position where it knows an IP, but doesn't know a MAC? I understand they operate on different layers, but wouldn't it have needed L2 to pass on that information at some point?