0

I have read other similar question on the forum and none have completely answered my question. But to understand my confusion, you would need to know what else I'm confused about.

Is ARP a layer-2 or a layer-3 protocol? As in, does a switch know about the existence of an ARP request, or does all it see is "a frame from a:b:c:d to FF:FF:FF:FF:FF:FF"?

Assuming that a switch doesn't know what is an ARP request, what would happen if I create an ARP request for an IP address outside the subnet (assume I've done this manually and bypassed the behaviour that would make the host reach to a gateway instead)? Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it, causing chaos?

Does the chaos continue, or does a L3 entity like a router eventually drop the packet?

3

Switches do forward broadcasts out all ports. They don't care what kind of broadcast it is, and they're unaware of layer 3 information. So yes, they'll forward it. L3 devices, like routers will drop broadcasts. Not sure what you consider "chaos."

3
  • By "chaos", I meant, if switches of different subnets were to be connected directly, they would just keep broadcasting to each other and others switches connected to them, causing network "chaos". I'm a networking noob so I don't know if such configuration even exists in real world, so my point might be senseless. May 5 at 13:55
  • @VivekYadav, that is why we have spanning tree. It breaks loops by blocking interfaces to build a single path toward the root bridge. What you describe is called a broadcast storm, and you can get that by disabling STP.
    – Ron Maupin
    May 5 at 14:18
  • 3
    I should clarify that when I say forward out all ports I mean all ports except the source port. So if switch A forwards a broadcast to B, B will not send it back to A. If there is a loop (spanning tree is disabled), then there will be a broadcast storm and chaos will ensue.
    – Ron Trunk
    May 5 at 14:34
0

If you send a broadcast ARP request for a host address of a host that is not connected to your network, then the ARP request will simply time out because no host on your network will claim the address. That happens regardless of the address being within your network range or not.

Switches do not know about frame payloads, e.g an ARP request, only the source and destination addresses, and an ARP request is broadcast, meaning a switch will send the request to all interfaces except the interface where the frame entered the switch. Switches are transparent devices, not looking at the frame payload or changing the frame.

2
  • So, does a switch directly connected to our switch, ignore the broadcast frame and not broadcast it within its own subnet? How does a router, then, perform an ARP request? May 5 at 13:49
  • Switches do not know about subnets. Routers perform ARP just like any other host on the LAN. ARP requests, being broadcasts, are confined to the broadcast domain, never crossing a router. Switches forward frames based on their destination layer-2 addresses, but routers strip off the layer-2 frames and forward packets based on their layer-3 addresses, building a new frame for the outgoing interfaces (possibly needing to use ARP on the outgoing LAN to address the layer-2 frame). ARP is used to get the layer-2 address for a layer-3 address on the broadcast domain.
    – Ron Maupin
    May 6 at 2:02
0

Is ARP a layer-2 or a layer-3 protocol?

Arguably, it's a layer-3 protocol (due to belonging to the IP core protocols). Technically, it rides directly on top of layer 2, why some call it "layer-2 protocol" which I think is wrong.

does a switch know about the existence of an ARP request, or does all it see is "a frame from a:b:c:d to FF:FF:FF:FF:FF:FF"?

The latter. A switch cares only about the L2 destination address for forwarding. The EtherType/next layer doesn't matter.

what would happen if I create an ARP request for an IP address outside the subnet

The ARP request is broadcast, without an answer.

Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it, causing chaos?

No chaos at all, just a broadcast spanning the broadcast domain (VLAN).

does a L3 entity like a router eventually drop the packet?

Yes. Limited broadcasts like that aren't forwarded by routers, only by bridges.

0

Is ARP a layer-2 or a layer-3 protocol?

ARP is the glue that allows IP to run over Ethernet without pre-configuring mappings from IP to MAC addresess. So logically you could say it fits between layers 2 and 3.

assume I've done this manually

At least on Linux there is no need to do this manually, you can just add an entry to the routing table with the desired interface and no nexthop.

Would a switch, being unaware of the fact that this IP is outside the subnet, just broadcast it, getting the frame to the next switch, which also being blind to layer-3 shenanigans, also broadcasts it,

Yes, the switch doesn't normally know or care about subnets.

causing chaos?

No, Ethernet networks are a tree. And Ethernet switches never forward frames "back the way they came". This is what allows a broadcast sent into an Ethernet network to be seen by every device exactly once.

If the Ethernet network is not a tree you will have "chaos" but you would have chaos even without your doctored arp request.

does a L3 entity like a router eventually drop the packet?

Routers don't forward ARP packets.


Most likely your out of subnet ARP request will simply receive no response. However there are a few ways you might end up getting a response.

  • The network admins may be running more than one IP subnet on the same L2 infrastructure. The systems in the other subnet may (or may not) respond to the ARP request despite the source being "out of subnet".
  • A router in the network may have "proxy ARP" enabled and reply to ARP requests for destintions it has routes to.
  • Some systems may have multiple interfaces with addresses in different subnets and may respond to ARP requests for any of their local addresses on any of their interfaces rather than tightly binding IP addresses to interfaces.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.