Hot answers tagged

28 votes
Accepted

Why do switches need ARP tables when the translation are done on the machines side?

This is a pretty common misconception or more specifically, a terminology problem. In a layer two switch, there is not an ARP table, only a forwarding table. The switch records each src MAC address ...
22 votes
Accepted

Can a router send ARP requests to hosts?

ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 ...
  • 96.7k
22 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
  • 96.7k
20 votes
Accepted

Should ARP requests be VLAN tagged?

Whether the frame is ARP or not is irrelevent. Anything sent out a trunk port is tagged with the VLAN the frame is a member of: ARP is sent by the client, the client typically has no knowledge of ...
  • 14.3k
19 votes

How does gratuitous ARP work?

A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the ...
  • 14.3k
18 votes
Accepted

How does a router find the next hop when the receiver is in a distant IP network?

Say I want to send a frame to a web server, and let's say this web server is in a very distant IP outside my local network e.g. a Google server. You're sending packets to remote destinations. Frames ...
  • 76.9k
17 votes

How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet

The sending device uses the subnet mask to determine if the remote host is in it's local network or not. If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address ...
  • 2,249
16 votes

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
  • 65k
13 votes
Accepted

Is there a way to capture only gratuitous ARP's using tcpdump?

In the usual tcpdump for Unix systems, only some fields are known by their name. Try specifying the opcode field by offset and size, and comparing with 2 ("reply") tcpdump -i eth99 arp and arp[6:2] =...
11 votes
Accepted

ARP request unicast MAC?

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from ...
  • 14.3k
10 votes
Accepted

Find MAC address of a remote computer using IP

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC ...
  • 387
10 votes

How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown

A device NEVER knows the subnet mask of another device. A device knows its IP address and its own subnet mask and based on this information knows in which network it resides. When host A sends a ...
  • 19k
9 votes

What is first? ARP vs ICMP

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to ...
  • 27k
9 votes

Find MAC address of a remote computer using IP

No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.
  • 96.7k
9 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was ...
9 votes
Accepted

ARP Router issue

I think you are confused about ARP requests. ARP requests are sent from a source host to the broadcast address, and every host on the broadcast domain will inspect the request. Only the host with the ...
  • 96.7k
8 votes
Accepted

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

Don't confuse the network layers. Each layer has a specific purpose. Also, don't assume that there is only one protocol for each layer. Layer-2 has many protocols, some of which use MAC addresses, and ...
  • 96.7k
8 votes
Accepted

When exactly is ARP protocol is used

Address Resolution Protocol (ARP) is used to resolve an IPv4 address (32 bit Logical Address) to the physical address (48 bit MAC Address). Network Applications at the Application Layer use IPv4 ...
  • 390
8 votes
Accepted

Why my computer is making this ARP requests to external (Gov) IP addresses?

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
  • 76.9k
8 votes

How does a host in one subnet know to forward the packet to the router MAC, when trying to send a packet to another subnet

To complement the other answers: The first thing a host (or router, which is just a host with multiple interfaces and packet forwarding between interfaces enabled) does is check its routing table. ...
  • 733
7 votes

Why do switches need ARP tables when the translation are done on the machines side?

Every device utilizing the IP protocol has an ARP table. Since IP is an L3 protocol and requires an underlying L2 protocol, this is a requirement for a device to be able to translate an L3 IP address ...
  • 27k
7 votes
Accepted

Do routers discard packets if they don't know where to forward them?

ARP is a LAN protocol that resolves a layer-3 to a layer-2 address. A router, like any host will use ARP for a host that is on a LAN to which it is directly connected. Routers will look at the ...
  • 96.7k
7 votes

How will be the ARP Request (Unicast/Broadcast) if Subnet Mask is Unknown

A device only knows its own subnet mask, and it helps the device to calculate which network it belongs to. Everything outside the network must go through the default gateway and everything in the ...
  • 4,457
7 votes

Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0

That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply). ARP works on top of layer 2 (Ethernet) and does not use a standard ...
  • 76.9k
7 votes
Accepted

What are the key advantages and disadvantages of NDP compared to ARP?

As Michael Hampton points out, ND does a great deal more than IPv4 ARP, but I will answer from the perspective of simply resolving a layer-2 address from a layer-3 address (ARP function). ARP ...
  • 96.7k
7 votes
Accepted

How does the ARP table work in case of the Gateway Router?

You've got a misconception there: Does ARP work this way in this case: 1-Host broadcasts an external IP address to the subnet asking who this is, 2- gateway router responds with its MAC, 3- For ...
7 votes

On a 3560E Switch

Most likely there is no Vlan interface on your switch. You can see, I have vlan10 and vlan11: swTST01#show vlan | include VLAN VLAN Name Status Ports 10 LAN_VLAN ...
  • 1,660
7 votes
Accepted

Why would a switch ever send an ARP request for a MAC address when it can just wait for the first packet to be received from a device?

You are confusing switching, where a switch creates and updates a MAC address table as frames pass through it, with the switch management. Switching is a layer-2 function, and a dumb switch will ...
  • 96.7k
6 votes
Accepted

ARP table is not updated with NMAP

What happens is desirable. It would not be desirable for an interface with multiple IP addresses to have the ARP cache changed every time one of the different addresses is used. The ARP cache will ...
  • 96.7k
6 votes

IP Address vs MAC Address, how does that really work together illustration

IP is a layer 3 protocol. It doesn't know anything about the physical media, it means that IP can travel through any media (for example: fiber optic, copper cable, air, etc). IP relies on a layer ...
  • 4,457

Only top scored, non community-wiki answers of a minimum length are eligible