Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

For questions about Address Resolution Protocol (ARP). ARP resolves OSI layer-3 addresses to OSI layer-2 addresses.

2
votes
1answer
210 views

How can I match conditions when I show arp?

In my Cisco Router I check the arp: Router>show arp Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.1.1 - 0001.42D2.AE01 ARPA ...
2
votes
3answers
71 views

Ping command through network

I have been trying to understand how and what tables are populated ( if they are clean at the start) when a ping command goes through. Lets say I have this network: I want to send a ping command from ...
0
votes
1answer
36 views

Why does arp request get broadcast even though it knows the ip address of receiver?

Since the arp request wants to know the Mac address of an ip address which belongs to any one device what's the purpose of sending a broadcast Anyway even though we know only that ip address device ...
0
votes
1answer
46 views

ARP requests from outside the network [closed]

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
0
votes
3answers
82 views

How did one go from IP to MAC in classful networks?

This is more of a question asked out of curiosity than for practical reasons, but it's bugging me, because it might point to a lack of understanding elsewhere. Back when classful IP addresses were ...
0
votes
1answer
51 views

How to capture ARP Reply packet from all hosts in the network?

How can I capture ARP reply packets from all hosts that are connected in the network? I've tried wireshark premicious mode but it only capture ARP replies from gateway.
0
votes
1answer
34 views

How can i monitor ARP packet on WiFi network?

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
5
votes
3answers
905 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
0
votes
3answers
65 views

Dynamically learned MAC address seems to never expire

I have a user getting error "No logon servers available" at login on a Windows machine. Topology is this: R1--SW1--IP phone--PC1 I cannot ping PC1 neither from its gateway R1 nor from SW1 (access ...
0
votes
1answer
38 views

What does “delta” stand for in arpwatch?

I've just set up Arpwatch on my pfSense machine and started getting emails about flip flops in my network. As the network is quite big, I understand that the flip flops indicate that a certain IP-...
0
votes
2answers
69 views

How to force users on my LAN to use a specific DNS server using ARP poisoning?

I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems. I've had problems in the past trying to configure my router's ...
0
votes
2answers
46 views

Why ARP need ARP cross LAN request?

Why ARP need ARP cross LAN request? When I am reading a document: You see the host A(10.1.0.1/8) send ARP Request for 20.2.0.1/8's MAC address. In general, the ARP request is for MAC address in the ...
1
vote
2answers
133 views

Why would pfSense ignore arp requests?

I'm configuring pfSense 2.4.3p1 as a transparent firewall. It's running in virtual machine with two vtnet paravirtualized adapters: WAN (vtnet0) connected to a 'far-side' network containing the ...
1
vote
3answers
78 views

Why do clients request a MAC via ARP, if the router knows the local LAN's MAC addresses already?

If I have an infrastructure type network, why does a local PC send out an ARP request for a MAC? Doesn't the router know the MAC addresses already, since it is using at least Layer 2? Does it do ...
4
votes
3answers
105 views

How to prevent IP conflict when using VRRP

We are currently using VSRP (Layer2/3) where we have a single IP as the gateway per VLAN. We are considering moving to VRRP (Layer3) which requires 3 IPs, 1 virtual and 2 real ones. This means that ...
0
votes
1answer
73 views

Iterative queries of a default DNS server

I have just started to study networks and I have a confusion about what happens when a default DNS server does iterative queries to other DNS servers to resolve a name in an IP address. I am very ...
0
votes
1answer
37 views

Network interface issues an ARP request to get the MAC address of an actively used gateway

My network interface actively uses a gateway to send IP packets to other networks. There is already an ARP entry in the cache for the IP/MAC association for the gateway. Is it normal that my network ...
0
votes
0answers
93 views

Sophos UTM WAN interface doesn't respond to ARP requests

I've sent this very question to Sophos Support but I feel that asking here might increase my chances to get an answer. The short question is: what could be the reason for my Sophos UTM VM WAN ...
3
votes
2answers
84 views

How does the ARP table work in case of the Gateway Router?

Suppose I am a host, I understand how ARP works in case I address an IP within my subnet. For each IP address there is a corresponding MAC address, and the owner responds to my broadcast ARP query. ...
1
vote
0answers
45 views

Same mac addresses for all the IPs [closed]

So I'm on a public wifi network and I'm trying to do intrusive testing. The issue is that while doing arp scan all the IPs are returning the same mac addresse.
1
vote
1answer
249 views

What are the key advantages and disadvantages of NDP compared to ARP?

So why they didn't use ARP in IPv6? is there any real benefit of doing this? what are the key advantages and disadvantages of using NDP instead of ARP? (In overall network performance, Security and ...
1
vote
1answer
47 views

Why would my router send an ARP request about a device that's already listed in its ARP cache?

I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
1
vote
3answers
317 views

If there's no response to the ARP request, will the host send to its default gateway?

Host A and B are on the same subnet. A sends ARP request(s) asking for B's MAC. For whatever reason, B doesn't respond. Will A either: Give up -- it can't reach B Send the packet to the default ...
3
votes
3answers
131 views

How to tell which one is the source IP and MAC address of the data being received?

I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code. Now the setup is something like this:- FPGA is connected to the pc via ethernet ...
0
votes
2answers
76 views

Router ARP Table

I have attached the topology, PC0 and PC1 are in same network (192.168.1.0/24) PC0 send packet PC1 directly after arp resolution. So why router arp table shows PC0 and PC1 mac address. (Although the ...
1
vote
1answer
96 views

Which MAC should be used: device MAC or Interface MAC?

My L3 switch has ~30 interfaces. If you look at the output below there are two MAC addresses showing in the results of the show interface command. The hardware address is the same for all interfaces. ...
5
votes
3answers
2k views

What are the reasons for seeing an incomplete ARP?

As was mentioned in this post: The reason for seeing an incomplete ARP is that "An ARP request was sent for that address, but the host with that address is not up and running on the LAN, so there is ...
2
votes
0answers
98 views

Cisco: Routing issue between LANs [closed]

We have a project to create 3 offices, which are 3 different LANs where the configuration should be as follows: Each Office should have 1 printer, where the office is able to print They should be ...
1
vote
2answers
318 views

Gratuitous arp and unicast flooding

we have few 100s of access switches connecting to a core 10k in IRF. Here all our access is pretty much dumb does only L2 job. So what happens now is unicast flooding, technically MAC ages out, ...
3
votes
1answer
66 views

Question about diagnosis of ARP spoofing

Hello, I'm studying link layer and ARP Spoofing. While I was searching ARP Spoofing on internet, I found that being attacked by ARP spoofing can be found by checking whether there are duplicate ...
2
votes
0answers
72 views

Brocade FastIron ignoring ARP cache settings

I have a Brocade FastIron FESX648 and I'm attempting to increase the ARP cache timeout on a port that is connected to an IXP. According to the Brocade docs, I can increase the timeout up to 4 hours ...
2
votes
2answers
784 views

Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0

Please help me to understand this behavior of one of my networking devices. It sends the ARP request broadcast with the source IP:0.0.0.0 . I am only aware about 0.0.0.0 being used in "ARP Probes" ...
4
votes
3answers
1k views

How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown

Please help me with one doubt regarding ARP requests. Based on my understanding the subnet of an IP is identified by it's Subnet Mask so consider this scenario:- Suppose Device1 with IP- 30.129.33....
1
vote
1answer
111 views

How would you map a network at layer 2 without CDP or LLDP?

I'm on an ASA right now and can path my directly connected next hop devices via IP address, but I want to make sure there isn't a switch in between. Another related question, when I "show arp" it ...
0
votes
0answers
260 views

IP Glean rate limiter

I have two data centres connected via dark fibre DWDM with Nexus 7700's either side, between them running OTV. When I fail over an F5 LTM with about 3000 Virtual Servers on one DC to the other DC F5 ...
1
vote
2answers
165 views

Endpoint MAC address change detection [closed]

A question regarding a host behavior when gateway mac address has changed (although it deals with Windows, I think it's the best forum). Assuming a windows host sending trafic to a destination IP, ...
1
vote
2answers
55 views

How to debug an unstable connection in a P2P configuration

I have a setup where I have two computers connected to each other (C1 and C2). Both have a static IP and they know each others IP. C2 sends UDP packets to C1 and C1 receives and logs them. Seems ...
0
votes
3answers
279 views

Cannot Ping Linux PC through L2 Switch

I’m a little embarrassed to be asking this but here goes. In a training video for CCENT, I see a switch connected to 2 PCs that are pinging each other on the same subnet. I try to replicate the ...
3
votes
3answers
332 views

Can the Ethernet source, ARP request SHA, ARP reply THA differ? Also ARP request TPA, and ARP reply SPA?

Can the Ethernet source, ARP request SHA, ARP reply THA differ? I take it for granted, that ARP request SHA, and ARP reply THA are always the same. But I'm not sure about whether the Ethernet source ...
1
vote
2answers
195 views

Ping a host that is in the same LAN

I'm trying to understand how the use of switches and routers in the same network work. This is related to this other question of mine. Suppose we have this network (I know this may not be a realistic ...
1
vote
1answer
1k views

Do routers discard packets if they don't know where to forward them?

If a router receives a packet whose IP destination address is not in its routing table, I believe it will send it to its default port. Suppose that we erase that entry from the table. Now, I think ...
1
vote
1answer
60 views

Does other hosts “learn” mac-ip entries on broadcast

in this post Learn MAC addresses via replies to other hosts requests I see that if host A sends an ARP query about host B, host C that resides in the same LAN will not learn host B MAC address, but ...
1
vote
1answer
209 views

arp or proxy-arp causing high cpu

We have an issue on a Cisco A901-6CZ-F-A with high cpu caused by Arp requests coming on Vlan11 from our customer. We enabled 'debug arp' to try and diagnose, below is a small snippet. IP addresses ...
2
votes
2answers
107 views

Two routers, one modem, dual IPs, second address drops connection occasionally

We have two ER-X connected via an unmanaged switch to a Cisco DPC3010 modem. Each is assigned a static WAN IP in a different block: 174.79.186.x/27 and 98.187.238.x/27. Every once in a while (roughly ...
1
vote
1answer
99 views

Multiple odd entries in ARP table of switch

While checking the ARP table on my switches, I found many entries that shouldn't be there. Before going into further details, I would like to emphasize that I'm talking about the ARP table and not ...
0
votes
1answer
95 views

Why does the `HWaddress` field of my router as returned by `arp` not match the output of `ifconfig`?

I am a software engineer trying to learn about networking from Ben Eater's video series. By looking at my wifi connection info, I think I have learned that my router's IP address is 172.20.20.1. (...
2
votes
2answers
272 views

Router issued ARP requests Target MAC = Broadcast, Host issued ARP requests Target MAC = 0's?

Why does an ARP request from my Router have a Target MAC Address: Broadcast While Host issued ARP requests always have Target MAC Address: 00:00:00:00:00:00? Also, I periodically see ARP requests ...
0
votes
2answers
154 views

Random ARP requests from source IP of different/nonexisting network

I saw this in wireshark and it worries me a bit: My network is 192.168.178.0/24. I already tried to look up the vendor from the MAC, no results. Why does it lookup what seems to be random IPs and ...
0
votes
3answers
102 views

Weird results when pinging

I'm learning IP addressing and routing basics, but I'm facing a problem which I cannot understand, so i have the following structure: Well in this situation, a ping from 130.190.0.16 to 130.190.4.30 ...
-2
votes
2answers
205 views

Does a router divide a LAN into two seperate LANs, or a single LAN with two subnets?

The figure below is part of a networking homework question. The question asks about the source/destination IP and MAC addresses of frames sent throughout the system. My question doesn't touch on that ...