Hot answers tagged

22 votes
Accepted

Can a router send ARP requests to hosts?

ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 ...
Ron Maupin's user avatar
  • 99.4k
22 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
Ron Maupin's user avatar
  • 99.4k
21 votes
Accepted

Should ARP requests be VLAN tagged?

Whether the frame is ARP or not is irrelevent. Anything sent out a trunk port is tagged with the VLAN the frame is a member of: ARP is sent by the client, the client typically has no knowledge of ...
Eddie's user avatar
  • 15k
19 votes

How does gratuitous ARP work?

A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the ...
Eddie's user avatar
  • 15k
18 votes
Accepted

How does a router find the next hop when the receiver is in a distant IP network?

Say I want to send a frame to a web server, and let's say this web server is in a very distant IP outside my local network e.g. a Google server. You're sending packets to remote destinations. Frames ...
Zac67's user avatar
  • 83.9k
17 votes

How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet

The sending device uses the subnet mask to determine if the remote host is in it's local network or not. If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address ...
Stuggi's user avatar
  • 2,259
16 votes

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
Ron Trunk's user avatar
  • 67.3k
15 votes
Accepted

ARP request with unicast MAC?

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from ...
Eddie's user avatar
  • 15k
14 votes
Accepted

Is there a way to capture only gratuitous ARP's using tcpdump?

In the usual tcpdump for Unix systems, only some fields are known by their name. Try specifying the opcode field by offset and size, and comparing with 2 ("reply") tcpdump -i eth99 arp and arp[6:2] =...
jonathanjo's user avatar
  • 16.2k
10 votes
Accepted

Find MAC address of a remote computer using IP

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC ...
Citizen's user avatar
  • 387
10 votes

How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown

A device NEVER knows the subnet mask of another device. A device knows its IP address and its own subnet mask and based on this information knows in which network it resides. When host A sends a ...
JFL's user avatar
  • 19.6k
9 votes

Find MAC address of a remote computer using IP

No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.
Ron Maupin's user avatar
  • 99.4k
9 votes
Accepted

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

Don't confuse the network layers. Each layer has a specific purpose. Also, don't assume that there is only one protocol for each layer. Layer-2 has many protocols, some of which use MAC addresses, and ...
Ron Maupin's user avatar
  • 99.4k
9 votes
Accepted

When exactly is ARP protocol is used

Address Resolution Protocol (ARP) is used to resolve an IPv4 address (32 bit Logical Address) to the physical address (48 bit MAC Address). Network Applications at the Application Layer use IPv4 ...
defalt's user avatar
  • 400
9 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was ...
jonathanjo's user avatar
  • 16.2k
9 votes
Accepted

ARP Router issue

I think you are confused about ARP requests. ARP requests are sent from a source host to the broadcast address, and every host on the broadcast domain will inspect the request. Only the host with the ...
Ron Maupin's user avatar
  • 99.4k
8 votes
Accepted

Why my computer is making this ARP requests to external (Gov) IP addresses?

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
Zac67's user avatar
  • 83.9k
8 votes
Accepted

How does the ARP table work in case of the Gateway Router?

You've got a misconception there: Does ARP work this way in this case: 1-Host broadcasts an external IP address to the subnet asking who this is, 2- gateway router responds with its MAC, 3- For ...
jonathanjo's user avatar
  • 16.2k
8 votes
Accepted

Why would a switch ever send an ARP request for a MAC address when it can just wait for the first packet to be received from a device?

You are confusing switching, where a switch creates and updates a MAC address table as frames pass through it, with the switch management. Switching is a layer-2 function, and a dumb switch will ...
Ron Maupin's user avatar
  • 99.4k
8 votes

How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet

To complement the other answers: The first thing a host (or router, which is just a host with multiple interfaces and packet forwarding between interfaces enabled) does is check its routing table. ...
jcaron's user avatar
  • 783
7 votes
Accepted

Do routers discard packets if they don't know where to forward them?

ARP is a LAN protocol that resolves a layer-3 to a layer-2 address. A router, like any host will use ARP for a host that is on a LAN to which it is directly connected. Routers will look at the ...
Ron Maupin's user avatar
  • 99.4k
7 votes

How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown

A device only knows its own subnet mask, and it helps the device to calculate which network it belongs to. Everything outside the network must go through the default gateway and everything in the ...
jcbermu's user avatar
  • 4,497
7 votes

Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0

That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply). ARP works on top of layer 2 (Ethernet) and does not use a standard ...
Zac67's user avatar
  • 83.9k
7 votes
Accepted

What are the key advantages and disadvantages of NDP compared to ARP?

As Michael Hampton points out, ND does a great deal more than IPv4 ARP, but I will answer from the perspective of simply resolving a layer-2 address from a layer-3 address (ARP function). ARP ...
Ron Maupin's user avatar
  • 99.4k
7 votes

On a 3560E Switch

Most likely there is no Vlan interface on your switch. You can see, I have vlan10 and vlan11: swTST01#show vlan | include VLAN VLAN Name Status Ports 10 LAN_VLAN ...
Mario Jost's user avatar
  • 1,700
6 votes

Multiple NICs, only eth0 can ping

You have all your interfaces in the same subnet. That is not going to work. Your computer can't figure out which interface to use to send to each host because it believes they are reachable from any ...
Ron Trunk's user avatar
  • 67.3k
6 votes
Accepted

Should a PC populate its ARP table when a frame is not destined to it?

Yes, this is expected behaviour. Even though PC3 sees the ARP request from PC1, it does not populate it's ARP cache with the IP-to-MAC mapping of PC1. While this may not seem to be the most efficient ...
Benjamin Dale's user avatar
6 votes
Accepted

Cisco HSRP CAM vs ARP timeout

What the ISP means is that as they make changes, you may lose connectivity for a time because the ARP table entries your router has with them will not match the changes it is making. If you reduce the ...
Ron Maupin's user avatar
  • 99.4k
6 votes
Accepted

When ARP cache is updated?

If that were to happen just as you state, then your pings would fail. In practise if you are using DHCP to hand out addresses, the server will give you back the same address. Even if it doesn't (...
marctxk's user avatar
  • 1,181
6 votes
Accepted

Can the Ethernet source, ARP request SHA, ARP reply THA differ? Also ARP request TPA, and ARP reply SPA?

Question 1: Can the Ethernet source, ARP request SHA, ARP reply THA differ? I take it for granted, that ARP request SHA, and ARP reply THA are always the same. But I'm not sure about whether the ...
Eddie's user avatar
  • 15k

Only top scored, non community-wiki answers of a minimum length are eligible