Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I am trying to understand the ARP protocol and I could not understand the above. Consider the topology as follows:
H1(1.1.1.1) - (1.1.1.0)R(2.2.2.0) - H2(2.2.2.2)
My understanding is that if the MAC table of host1 does not have an entry for destination MAC of host2, it would send an ARP query with the destination IP(2.2.2.2), which would not be found on the subnet and the packet would be discarded. But how is the packet sent to the gateway(router or 1.1.1.0) instead?
The sending device uses the subnet mask to determine if the remote host is in it's local network or not.
If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address of the remote host.
If it's outside, it queries it's local routing table to find the next hop of that IP, and sends out an ARP query to find the MAC address for that next hop. On most machines, the routing table just has a default route which is the upstream router, but you can define multiple routes manually. However, there can only be one default route, so if you machine has multiple interfaces, you shouldn't define a default gateway on more than one. (since the default gateway setting essentially adds a route for 0.0.0.0/0 (aka. every single host) with the gateway set to that IP).
To complement the other answers:
The first thing a host (or router, which is just a host with multiple interfaces and packet forwarding between interfaces enabled) does is check its routing table.
The most basic routing table will usually have:
one entry for the local network, pointing to the relevant interface
one default route, pointing to the default gateway
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 1.1.1.0 0.0.0.0 UG 0 0 0 eth0
1.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
There could be more routes depending on the interfaces and the implementation, but this is the most basic form.
Routes are always looked up as "more specific" first. "More specific" means the route covers a smaller number of destination addresses (the prefix length is longer, or if you still talk in terms of subnet masks, the number of 1s in the subnet mask is higher).
This means a route for a single host (a /32, netmask 255.255.255.255) is more specific that a route for a /24 (netmask 255.255.255.0) which is more specific than the default route which is a /0 (netmask 0.0.0.0). If all 3 routes "match", then the first one will be used, and so on.
For a packet that is destined to an IP on the local network, the host will find the route that tells it that this network is connected to that interface. It will find out that it's an Ethernet interface which uses ARP, and will lookup its ARP table (which is sometimes merged with the routing table, depending on the implementation). If it doesn't find the relevant ARP entry, it will then issue an ARP request.
For a packet that is destined to an IP not on the local network, it will fall back to the default route, which gives it the IP of the default gateway. Then the exercise starts again using that IP, which is now on the local network (if it wasn't, then the packet would be dropped).
There are 3 pieces of information that your computer needs in order to do this. In a typical setup, they're all provided by DHCP. If you assign a static IP address, you have to provide them all to make this work.
We're going to start off providing the both pieces of data that are missing. We'll set the subnet mask of both networks to 255.255.0.0. We'll set the default gateway of network1 to 1.1.1.0 and the default gateway of network2 to 2.2.2.0
Next... in your scenario host1 would never bother trying to send out an ARP query for host 2.2.2.2 because it can figure out that the IP address for 2.2.2.2 isn't on it's network from the combination of IP addresses and subnet mask. Each IP is combined (using an bitwise AND operation) with the subnet mask to provide the network address the computer is on. 1.1.1.1 AND 255.255.0.0 = 1.1.0.0. 2.2.2.2 AND 255.255.0.0 = 2.2.0.0. 1.1.0.0 does not equal 2.2.0.0, and thus these IP addresses originate on different networks. Because they're on different networks, the computer doesn't need to ARP. The default gateway is named such (I assume at least) because it's the default location to send any traffic that is on a different network.
It may help to distinguish what is happening at the IP level (and would behave differently if you were using a different protocol at the routed layer), what is happening at the Ethernet level (and would behave differently if you were using a different protocol at the link layer), and what is happening in the middle (the packet encapsulation, as well as the ARP resolution which is at least conceptually not specific to IP or Ethernet). I'll describe these as happening in three different software drivers, although in practice two or three of these drivers may well be combined.
First the IP driver consults the IP routing table to determine who must receive the packet for the given target IP address. A query to the IP routing table may return one of three possible results:
If a route is found, the IP driver remembers not only the final result which is the network interface, but also the IP address to send the packet to at the link layer (which is the last gateway found in the recursive lookup, or the original target IP address if no gateway was found).
In your example, the route to 2.2.2.2 goes via the gateway 1.1.1.0, which is on a certain Ethernet interface of the host, let's call it eth0. So the IP driver hands down the packet to the IP-over-Ethernet driver, telling it to transmit it to 1.1.1.0 on eth0.
The IP-over-Ethernet driver maintains a cache that associates IP addresses to MAC addresses. If it doesn't find the requested IP address in its cache, it sends an ARP request and waits for the answer. If it doesn't get an answer, it rejects the packet as undeliverable. Note that the IP-over-Ethernet driver only cares about the gateway address, not about the packet's final destination.
So the sending host will make an ARP request for 1.1.1.0. It would never try an ARP request to 2.2.2.2 since it knows it doesn't have a direct route to it.
When the IP-over-Ethernet driver has found the MAC address of 1.1.1.0, it hands down the packet to the Ethernet driver, telling it to send to that particular MAC address. The Ethernet driver sends an Ethernet frame. It doesn't care about IP addresses.
The easiest way to understand what's happening is to look at each layer one at a time.
When Host1 sends a packet to Host2 it consults its local routing table. The possible outcomes are:
IP uses the data link layer to send packets within a local network. It requires a way to accomplish send a packet to X, to address the target node. For MAC-based networks, the MAC address is required for addressing, and IPv4 uses ARP to find out that MAC address.
So, for direct addressing the destination IP is ARPed, and for a gateway that IP is ARPed. The resolved MAC address is used to direct the frame to X.
