Follow the PING

Ok I'm confused. I thought that when a host sends data to another PC assuming that all is well.

The sending host will fill its ARP table with the IP address of the destination host, but the MAC address will be the address of the first device attached to the PC? (the one doing the sending)

So I have my router connected to my switch which is also connected to by the PC.

My ARP table in my PC shows the ACTUAL mac address of the router interface and it's IP address.

I thought that I should be seeing the IP address of the router interface but the MAC address of the switchport that the PC is plugged into no??

Find more posts tagged with

SAVE $250 on Your CISCO Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View CISCO Boot Camps

Comments

Forsaken_GA

why would you?

ARP is a way to map layer 3 addresses to layer 2 addresses. The switchport you're connected to doesn't have a layer 3 address, so what's it going to map to?

When your computer issues an arp request, it says 'hey guys, who's got the mac for x.x.x.x?' and the interface with x.x.x.x responds with it's mac address, and your computers stores the mac for that IP in it's arp table.

hexem

As above..

the switch keep's it's own table of where each host can be found by learning the source mac addresses off each port, so when you send out an arp broadcast it get's flooded out all ports and the receiving host with that ip address will send back the reply, once you're host has it's arp table built and the switch has an entry for that mac address in it's table everything is point-to-point until the entries age out or the host moves to a diff port or changes ip address.

notgoing2fail

Ok so if you have a diagram like this:

PC <--Switch 1--> <--Switch 2--> <--Switch 3--> Router

Then the MAC address of the router interface will still be placed in the PC's ARP table matching whatever IP address it was trying to communicate with right?

So those 3 switches are passing down router's MAC address to the PC?

networker050184

notgoing2fail wrote: »

Ok so if you have a diagram like this:

PC <--Switch 1--> <--Switch 2--> <--Switch 3--> Router

Then the MAC address of the router interface will still be placed in the PC's ARP table matching whatever IP address it was trying to communicate with right?

So those 3 switches are passing down router's MAC address to the PC?

Yep thats how it works. The arp request will be broadcast so the switches will flood the request. The reply will be switched back to the source.

notgoing2fail

Ok great this is one of those fundamental concepts that's really important.

I think I get the jist of it now, thanks guys!

Forsaken_GA

notgoing2fail wrote: »

Ok great this is one of those fundamental concepts that's really important.

I think I get the jist of it now, thanks guys!

yeah, alot of folks overlook arp and how it actually works, and it's absolutely stupid how many problems crop up that can be attributed to arp.

just keep in mind that the arp table is not a table to store all known mac-addresses for. Hosts don't do that, and neither does an arp table. Switches/Hubs/Bridges are going to be the devices that hold full mac-address tables for the entire network, because they're the ones doing the layer 2 transport.

The reason a host needs an arp table is because if it wants to send traffic to someone, it can't do so directly at layer 3..... it needs to encapsulate the layer 3 packet to the layer 2 frame. If it doesn't know which IP address is associated with which mac address, then it doesn't know how to properly address the layer 2 frame.

So when Host A wants to send to Host B, it knows hosts B IP address, so it constructs the packet with host B's ip as the destination IP, then when it goes to put the packet into an ethernet frame, it looks up host B's ip in the arp table to get it's mac address, and then uses that mac address as the destination mac address. This is assuming that host B is on the same subnet.

If Host A is trying to reach host C, and host C is on a different network, it constructs the packet with host C's destination IP address. But since it's going off network, it can't go directly to host c, it has to go to the default gateway first. Since it's being sent to the default gateway, it looks up the default gateways ip in the arp table, and then uses the default gateways mac-address as the destination mac address in the ethernet frame. From there, the router takes over and sends it along it's way.