1

I am currently researching ARP packets using Wireshark and have found that when I ping a new computer asking for the MAC address that corresponds with the known IP address, my target IP address in my request ARP packet is always my default gateway.

Why is this?

Improve this question
2
  • 1
    Are you asking about a situation where you ARP for an address that isn't on the subnet? While it's not required to answer, it would be helpful to know how are you sending the ARP, because by default anything with a correct default gateway won't send ARP packets for remote subnets (i.e. off your connected subnet).
    – Mike Pennington
    Commented Jan 26, 2014 at 23:58
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 7, 2017 at 18:04

2 Answers 2

Reset to default
4

ARP is used to find an ethernet MAC address belonging to an IPv4 address on your local LAN.

If you are sending packets to something that is not on your local LAN (according to the information that your PC has) your PC will send it to the default gateway, who is assumed to know what to do with it.

So, if you send something to an non-LAN destination your PC needs the MAC address of the default gateway, which it will send an ARP request for if it doesn't have it cached yet.

It is not possible to see MAC addresses of machines not on your local LAN.

Improve this answer
5
  • It sounds like she is proxy-arping... you may want to add something about that, just in case. Most likely case in my mind is a mismatched subnet mask, but this is wild speculation.
    – Mike Pennington
    Commented Jan 27, 2014 at 0:11
  • @MikePennington: if the ARP target IP is the address of the gateway it's normal ARP for the gateway. Proxy-ARP would make the gateway answer for off-net addresses, but if the request is on-net then it's normal ARP.
    – Sander Steffann
    Commented Jan 27, 2014 at 11:06
  • My point is that proxy-arp is configurable, and you can turn it off, if this indeed was what is confusing the OP
    – Mike Pennington
    Commented Jan 27, 2014 at 12:24
  • It wasn't within the same subnet though. It is in a research networking environment, 192.168.XXX.XXX class. There are maybe a total of 15 routers and my default gateway was 192.168.50.1 while I pinged the following addresses 192.168.40.52, 192.168.20.1, etc. However my target IP address in my request ARP packet is always my default gateway.
    – beckah
    Commented Jan 29, 2014 at 20:51
  • @rsheeler: indeed. Your PC wants to send a packet to a different subnet. It can't reach it directly but it has a gateway that it knows it can reach directly over the LAN. It does an ARP request to find out the MAC address of the default gateway, and then sends the packet to that MAC address, assuming that the gateway will handle its further delivery.
    – Sander Steffann
    Commented Jan 30, 2014 at 8:29
0

If the ping destination IP(Y) is within the same subnet with your source IP(X), you'll see your expected result, which is Y in the ARP reply.

If the ping destination IP is in different subnet from your LAN, you'll see the gateway IP in in the ARP reply.

Improve this answer
1
  • It wasn't within the same subnet though. It is in a research networking environment, 192.168.XXX.XXX class. There are maybe a total of 15 routers and my default gateway was 192.168.50.1 while I pinged the following addresses 192.168.40.52, 192.168.20.1, etc. However my target IP address in my request ARP packet is always my default gateway.
    – beckah
    Commented Jan 29, 2014 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.