22
votes
Accepted
Can a router send ARP requests to hosts?
ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 ...
- 101k
22
votes
Does every host on the LAN share the same ARP table, or do hosts keep them individually?
Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
- 101k
21
votes
Accepted
Should ARP requests be VLAN tagged?
Whether the frame is ARP or not is irrelevent. Anything sent out a trunk port is tagged with the VLAN the frame is a member of:
ARP is sent by the client, the client typically has no knowledge of ...
- 15.2k
19
votes
How does gratuitous ARP work?
A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the ...
- 15.2k
18
votes
Accepted
How does a router find the next hop when the receiver is in a distant IP network?
Say I want to send a frame to a web server, and let's say this web server is in a very distant IP outside my local network e.g. a Google server.
You're sending packets to remote destinations. Frames ...
- 88.1k
17
votes
How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet
The sending device uses the subnet mask to determine if the remote host is in it's local network or not.
If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address ...
- 2,269
14
votes
Accepted
Is there a way to capture only gratuitous ARP's using tcpdump?
In the usual tcpdump for Unix systems, only some fields are known by their name.
Try specifying the opcode field by offset and size, and comparing with 2 ("reply")
tcpdump -i eth99 arp and arp[6:2] =...
- 16.4k
10
votes
How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown
A device NEVER knows the subnet mask of another device.
A device knows its IP address and its own subnet mask and based on this information knows in which network it resides.
When host A sends a ...
- 19.8k
9
votes
Accepted
When exactly is ARP protocol is used
Address Resolution Protocol (ARP) is used to resolve an IPv4 address (32 bit Logical Address) to the physical address (48 bit MAC Address). Network Applications at the Application Layer use IPv4 ...
- 400
9
votes
Does every host on the LAN share the same ARP table, or do hosts keep them individually?
To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was ...
- 16.4k
9
votes
Accepted
ARP Router issue
I think you are confused about ARP requests. ARP requests are sent from a source host to the broadcast address, and every host on the broadcast domain will inspect the request. Only the host with the ...
- 101k
9
votes
Why don't routers answer ARP requests for IP addresses they can handle even if they aren't assigned that IP address themselves?
OK, so you have these (theoretical) options:
The TCP/IP way:
Any time I want to send a packet to a new IP not on the local network:
I lookup the IP of the default gateway (in the local routing table)...
- 873
8
votes
Accepted
Why my computer is making this ARP requests to external (Gov) IP addresses?
169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
- 88.1k
8
votes
Accepted
How does the ARP table work in case of the Gateway Router?
You've got a misconception there:
Does ARP work this way in this case: 1-Host broadcasts an external IP address to the subnet asking who this is, 2- gateway router responds with its MAC, 3- For ...
- 16.4k
8
votes
Accepted
Why would a switch ever send an ARP request for a MAC address when it can just wait for the first packet to be received from a device?
You are confusing switching, where a switch creates and updates a MAC address table as frames pass through it, with the switch management.
Switching is a layer-2 function, and a dumb switch will ...
- 101k
8
votes
How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet
To complement the other answers:
The first thing a host (or router, which is just a host with multiple interfaces and packet forwarding between interfaces enabled) does is check its routing table.
...
- 873
8
votes
Accepted
Why don't routers answer ARP requests for IP addresses they can handle even if they aren't assigned that IP address themselves?
Let's say the router didn't have any IP address assigned either
The router would not be an IP router for that router interface because it would not know about the network directly connected to it. A ...
- 101k
8
votes
Why don't routers answer ARP requests for IP addresses they can handle even if they aren't assigned that IP address themselves?
As many have answered, the function to providing routing when an endstation is not aware of a router is called Proxy ARP. It used to be commonly enabled by routers, to provide service to ...
- 201
7
votes
Accepted
Do routers discard packets if they don't know where to forward them?
ARP is a LAN protocol that resolves a layer-3 to a layer-2 address. A router, like any host will use ARP for a host that is on a LAN to which it is directly connected.
Routers will look at the ...
- 101k
7
votes
How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown
A device only knows its own subnet mask, and it helps the device to calculate which network it belongs to.
Everything outside the network must go through the default gateway and everything in the ...
- 4,497
7
votes
Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0
That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply).
ARP works on top of layer 2 (Ethernet) and does not use a standard ...
- 88.1k
7
votes
Accepted
What are the reasons for seeing an incomplete ARP?
For a layer-3 switch, the layer-3 module in the switch is a router, and it works just like a router, which works like any other host for ARP. A layer-3 switch is still primarily a layer-2 switch, and ...
- 101k
7
votes
Accepted
What are the key advantages and disadvantages of NDP compared to ARP?
As Michael Hampton points out, ND does a great deal more than IPv4 ARP, but I will answer from the perspective of simply resolving a layer-2 address from a layer-3 address (ARP function).
ARP ...
- 101k
7
votes
On a 3560E Switch
Most likely there is no Vlan interface on your switch. You can see, I have vlan10 and vlan11:
swTST01#show vlan | include VLAN
VLAN Name Status Ports
10 LAN_VLAN ...
- 1,729
6
votes
Accepted
Should a PC populate its ARP table when a frame is not destined to it?
Yes, this is expected behaviour.
Even though PC3 sees the ARP request from PC1, it does not populate it's ARP cache with the IP-to-MAC mapping of PC1.
While this may not seem to be the most efficient ...
- 9,565
6
votes
Accepted
Cisco HSRP CAM vs ARP timeout
What the ISP means is that as they make changes, you may lose connectivity for a time because the ARP table entries your router has with them will not match the changes it is making. If you reduce the ...
- 101k
6
votes
Accepted
When ARP cache is updated?
If that were to happen just as you state, then your pings would fail.
In practise if you are using DHCP to hand out addresses, the server will give you back the same address. Even if it doesn't (...
- 1,181
6
votes
Accepted
Can the Ethernet source, ARP request SHA, ARP reply THA differ? Also ARP request TPA, and ARP reply SPA?
Question 1:
Can the Ethernet source, ARP request SHA, ARP reply THA differ? I take it for granted, that ARP request SHA, and ARP reply THA are always the same. But I'm not sure about whether the ...
- 15.2k
6
votes
Accepted
What is the characteristic of spoofed ARP packets?
If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.
What makes a real ARP reply real? It came from the ...
- 16.4k
Only top scored, non community-wiki answers of a minimum length are eligible