1

I am currently researching ARP packets using Wireshark and have found that when I ping a new computer asking for the MAC address that corresponds with the known IP address, my target IP address in my request ARP packet is always my default gateway.

Why is this?

  • 1
    Are you asking about a situation where you ARP for an address that isn't on the subnet? While it's not required to answer, it would be helpful to know how are you sending the ARP, because by default anything with a correct default gateway won't send ARP packets for remote subnets (i.e. off your connected subnet). – Mike Pennington Jan 26 '14 at 23:58
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 18:04
4

ARP is used to find an ethernet MAC address belonging to an IPv4 address on your local LAN.

If you are sending packets to something that is not on your local LAN (according to the information that your PC has) your PC will send it to the default gateway, who is assumed to know what to do with it.

So, if you send something to an non-LAN destination your PC needs the MAC address of the default gateway, which it will send an ARP request for if it doesn't have it cached yet.

It is not possible to see MAC addresses of machines not on your local LAN.

| improve this answer | |
  • It sounds like she is proxy-arping... you may want to add something about that, just in case. Most likely case in my mind is a mismatched subnet mask, but this is wild speculation. – Mike Pennington Jan 27 '14 at 0:11
  • @MikePennington: if the ARP target IP is the address of the gateway it's normal ARP for the gateway. Proxy-ARP would make the gateway answer for off-net addresses, but if the request is on-net then it's normal ARP. – Sander Steffann Jan 27 '14 at 11:06
  • My point is that proxy-arp is configurable, and you can turn it off, if this indeed was what is confusing the OP – Mike Pennington Jan 27 '14 at 12:24
  • It wasn't within the same subnet though. It is in a research networking environment, 192.168.XXX.XXX class. There are maybe a total of 15 routers and my default gateway was 192.168.50.1 while I pinged the following addresses 192.168.40.52, 192.168.20.1, etc. However my target IP address in my request ARP packet is always my default gateway. – beckah Jan 29 '14 at 20:51
  • @rsheeler: indeed. Your PC wants to send a packet to a different subnet. It can't reach it directly but it has a gateway that it knows it can reach directly over the LAN. It does an ARP request to find out the MAC address of the default gateway, and then sends the packet to that MAC address, assuming that the gateway will handle its further delivery. – Sander Steffann Jan 30 '14 at 8:29
0

If the ping destination IP(Y) is within the same subnet with your source IP(X), you'll see your expected result, which is Y in the ARP reply.

If the ping destination IP is in different subnet from your LAN, you'll see the gateway IP in in the ARP reply.

| improve this answer | |
  • It wasn't within the same subnet though. It is in a research networking environment, 192.168.XXX.XXX class. There are maybe a total of 15 routers and my default gateway was 192.168.50.1 while I pinged the following addresses 192.168.40.52, 192.168.20.1, etc. However my target IP address in my request ARP packet is always my default gateway. – beckah Jan 29 '14 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.