Hot answers tagged

44

Gratuitous ARP is a sort of "advance notification", it updates the ARP cache of other systems before they ask for it (no ARP request) or to update outdated information. When talking about gratuitous ARP, the packets are actually special ARP request packets, not ARP reply packets as one would perhaps expect. Some reasons for this are explained in ...


37

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and port number. Switches follow this simple algorithm for forwarding packets: When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the port number the packet was ...


24

This is a pretty common misconception or more specifically, a terminology problem. In a layer two switch, there is not an ARP table, only a forwarding table. The switch records each src MAC address it sees inbound in the forwarding table, and attributes it to the port so frames with a dst MAC will only get sent to the port known for that MAC. Many people ...


20

ARP is layer 2. The reason being is that a broadcast is sent on layer 2 (data link layer) and ARP will normally not traverse to layer 3 (network layer). However it can provide extra features to the layer 3 protocol. The truth is that not all protocols fit the OSI model exactly, because after all it's just a model. If you really want to push it into a spot ...


20

ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 addresses to layer-2 addresses, the same way a PC on a LAN does.


19

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy). To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all ...


19

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in the same host, but a host may hear ARP traffic on the network and update the ARP table of the interface where the ARP traffic is heard.


18

Whether the frame is ARP or not is irrelevent. Anything sent out a trunk port is tagged with the VLAN the frame is a member of: ARP is sent by the client, the client typically has no knowledge of what VLAN it is a member of. It is therefore unable to add a VLAN tag, and shouldn't be expected to. The ARP the client sends will arrive on the switch untagged. ...


17

IPv4: It will "flap". On the sending host (another host or the gateway/router) there will be an ARP entry for the IP pointing to the MAC address of one of the hosts. Packets will go to one of the hosts, wherever the ARP entry currently points. This will effectively disrupt connectivity for both hosts. IPv6: The neighbor discovery protocol will do a ...


17

The sending device uses the subnet mask to determine if the remote host is in it's local network or not. If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address of the remote host. If it's outside, it queries it's local routing table to find the next hop of that IP, and sends out an ARP query to find the MAC address ...


15

A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the entire network. An ARP Packet contains an "Opcode" field which indicates whether the packet is a request or a response. In the Gratuitous ARP, the Opcode field is ...


14

The simple answer is to make the CAM timer equal or slightly longer than the corresponding interface ARP timer, but there are at least three different options to select from... Option 1: Lower all interface ARP Timers This option works best if you have a decent-sized layer2 switched network, a reasonable number of ARP entries and few routed interfaces. ...


14

Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4. To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses is done by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away, as is the custom with legacy ...


12

I am assuming you're using "bridge-mode" for networking (your internal, virtual adapter is bridged to your host's physical adapter). In any case (unless you explicitlly manually set them to the same address, which causes a lot of other problems), your guest (WinXP) machine will have a different MAC address than your host (CentOS). Due to bridge-mode, your ...


12

An ICMP Echo request from the DHCP server to the IP address its about to allocate is used to determine if the IP address about to be assigned is already in use on the network. If a response is received from that IP the DHCP server will assign a different address. The ARP request on the newly received address from the client would do the same, check if ...


12

It's neighbor unreachability detection (NUD). The node makes sure that the gateway is still alive and reachable.


12

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As networks got bigger and became interconnected, there was a need to know how to get from one network to another. That is the function of routing, which is done ...


11

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC address as it is stripped from the packet once it crosses the boundary of a router/L3 device. Switches have a MAC table. Routers have a routing table, in general. ...


10

Your reasoning is the wrong way. TCP/IP handles the layers top down, not bottom up. PC A will first do a lookup in the routing table and decide that the only way to reach PC B is via the router specified in that routing table. If the MAC address of the router is unknown it will send an ARP request to figure out which MAC address corresponds to the gateway ...


10

Using your original diagram: When Computer A tries to communicate with Computer C, the following steps resolve Router 1's software-assigned address to its hardware-assigned media access control address: Based on the contents of the routing table on Computer A, IP determines that the forwarding IP address to be used to reach Computer C is through Router 1, ...


10

A device NEVER knows the subnet mask of another device. A device knows its IP address and its own subnet mask and based on this information knows in which network it resides. When host A sends a packet to host A it determines if B is in the local network solely by looking up B's IP address. Example 1: Host A : IP 30.129.33.225 - subnet mask 255.255.255....


9

Answering the original router question: Arp caches are there to map an IP addess to a mac address. There's nothing unique about a router. .. it needs an ARP cache just like any other IP device. Managed switches likewise need an Arp cache so they can communicate with the stations managing them. As we discussed in chat, you need to add an IP address to your ...


9

GLBP doesn't use gratuituous ARP. When someone asks which MAC does the virtual IP have, the AVG will reply saying "This IP is at this MAC", using the field "Sender MAC Address", which is invisible to the switch's CAM table. The source address is still the AVG MAC. EDIT: I said it wrong. The IP address requested is actually the Sender, the Target address is ...


9

Many devices will send these types of ARP requests after entries in the ARP table reach a "certain" age to refresh those entries. The reason they do this is so they can maintain valid ARP entries without having to broadcast ARP for hosts once the entries age out. Directed ARP is much "friendlier" to a network than broadcast ARP.


9

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to the frame before sending it on the wire. This IP-to-MAC mapping is exactly what the ARP process is there to provide to the host. Based on this statement, one ...


9

No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.


9

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network. This will be the first time I've seen it with a ...


9

To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was trying to share ARP information with another device, it would have to do something like broadcast the entries of the ARP table, knowing when to get updates ...


8

If there's a duplicate IP address, which one "wins"? First, last, flaps, neither? I have been thinking about this question for the last six hours... I think the most appropriate answer is "Nobody wins". In other words, at least two computers can't be used reliably. Furthermore, you are spending time fixing a problem, and that time could have been used on ...


8

ARP is the protocol that gives you the MAC address (layer 2) of a given IP address (layer 3). On ethernet all communication is done using MAC addresses. Switches and other layer 2 devices only look at the MAC addresses of the packets (on layer 2 usually called frames). They don't care about the content of the frames. That is the job of layer 3. So, for ...


Only top voted, non community-wiki answers of a minimum length are eligible