What if a host makes an ARP request for an IP outside its subnet?

Question

I have read other similar question on the forum and none have completely answered my question. But to understand my confusion, you would need to know what else I'm confused about.

Is ARP a layer-2 or a layer-3 protocol? As in, does a switch know about the existence of an ARP request, or does all it see is "a frame from a:b:c:d to FF:FF:FF:FF:FF:FF"?

Assuming that a switch doesn't know what is an ARP request, what would happen if I create an ARP request for an IP address outside the subnet (assume I've done this manually and bypassed the behaviour that would make the host reach to a gateway instead)? Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it, causing chaos?

Does the chaos continue, or does a L3 entity like a router eventually drop the packet?

Answer 1

Switches do forward broadcasts out all ports. They don't care what kind of broadcast it is, and they're unaware of layer 3 information. So yes, they'll forward it. L3 devices, like routers will drop broadcasts. Not sure what you consider "chaos."

Answer 2

If you send a broadcast ARP request for a host address of a host that is not connected to your network, then the ARP request will simply time out because no host on your network will claim the address. That happens regardless of the address being within your network range or not.

Switches do not know about frame payloads, e.g an ARP request, only the source and destination addresses, and an ARP request is broadcast, meaning a switch will send the request to all interfaces except the interface where the frame entered the switch. Switches are transparent devices, not looking at the frame payload or changing the frame.

Answer 3

Is ARP a layer-2 or a layer-3 protocol?

Arguably, it's a layer-3 protocol (due to belonging to the IP core protocols). Technically, it rides directly on top of layer 2, why some call it "layer-2 protocol" which I think is wrong.

does a switch know about the existence of an ARP request, or does all it see is "a frame from a:b:c:d to FF:FF:FF:FF:FF:FF"?

The latter. A switch cares only about the L2 destination address for forwarding. The EtherType/next layer doesn't matter.

what would happen if I create an ARP request for an IP address outside the subnet

The ARP request is broadcast, without an answer.

Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it, causing chaos?

No chaos at all, just a broadcast spanning the broadcast domain (VLAN).

does a L3 entity like a router eventually drop the packet?

Yes. Limited broadcasts like that aren't forwarded by routers, only by bridges.

Answer 4

Is ARP a layer-2 or a layer-3 protocol?

ARP is the glue that allows IP to run over Ethernet without pre-configuring mappings from IP to MAC addresess. So logically you could say it fits between layers 2 and 3.

assume I've done this manually

At least on Linux there is no need to do this manually, you can just add an entry to the routing table with the desired interface and no nexthop.

Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it,

Yes, the switch doesn't normally know or care about subnets.

causing chaos?

No, Ethernet networks are a tree. And Ethernet switches never forward frames "back the way they came". This is what allows a broadcast sent into an Ethernet network to be seen by every device exactly once.

If the Ethernet network is not a tree you will have "chaos" but you would have chaos even without your doctored arp request.

does a L3 entity like a router eventually drop the packet?

Routers don't forward ARP packets.

---

Most likely your out of subnet ARP request will simply receive no response. However there are a few ways you might end up getting a response.

• The network admins may be running more than one IP subnet on the same L2 infrastructure. The systems in the other subnet may (or may not) respond to the ARP request despite the source being "out of subnet".
• A router in the network may have "proxy ARP" enabled and reply to ARP requests for destintions it has routes to.
• Some systems may have multiple interfaces with addresses in different subnets and may respond to ARP requests for any of their local addresses on any of their interfaces rather than tightly binding IP addresses to interfaces.