ARP Question

I want to know, whats the reason behind it? Why is a particular host is caching the hardware address when a switch is smart enough to do this for you? i.e mac address table.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Zartanasaurus

What else is in the ARP table besides the mac? How does that compare to the mac address table?

pumpkin12345678

The switch is finding the mac address for you? why the hell do you need a ARP on a local host

networker050184

The switch knows how to get to the MAC, it doesn't know which IP corresponds to that MAC. That is what ARP is for. If it wasn't for ARP you'd have to know the MAC for everything you wanted to reach instead of the IP. Then you couldn't just spin up a new server and put the old IP on it and expect it to work for example. Not to mention things that aren't on the same L2 segment....

EdTheLad

Two machines are connected via ethernet, they are both configured on the same subnet 10.0.0.0/24. Machine 1 wants to send a ping to machine 2. On the command line on machine 1 you enter the ping command "ping 10.0.0.2" .
Machine 1 now needs to create a frame to send to machine 2, it knows the src and dst ip addresses, it knows the src mac address for the frame, but it doesn't know the destination mac address of machine 2. Without arp machine 1 cannot complete the layer 2 header, communication fails.

When arp is running machine 1 will send an arp request to machine 2 when it doesnt know the dest mac address, it will save the result in the cache to improve performance for next time it needs to send frames to machine 2.

pumpkin12345678

I am still totally confused.
ARP (Address resolution protocol) works on Layer 2
Why the hell do you need know the IP address side of things its layer 3

EdTheLad

Which application are you using that is using layer 2 only communications? Why do you want to send layer 2 frames?

pumpkin12345678

Bro, The switch is smart is smart enough to figure out the MAC address for each locally attached device and the router is obsessed about networks

Then why ARP is needed on a host

Can someone please illustrate on a figure please and explain it

bradl3yC

pumpkin12345678 wrote: »

Bro, The switch is smart is smart enough to figure out the MAC address for each locally attached device and the router is obsessed about networks

Then why ARP is needed on a host

Can someone please illustrate on a figure please and explain it

When devices are trying to communicate on the same network, they look at their IP, the destination IP and the subnet mask. Once it is established that the devices are on the same network, the device thats initiating the communication will ARP for the MAC address corresponding with the destination IP. That device will reply with its mac and the frame is sent to the switch with that destination mac. Switch then forwards that information to the port that corresponds to that mac address by looking at its MAC table.

I hope thats close, I am just going through ICND1

EdTheLad

Yes u are correct, arp isn't needed at all, the switch call do it all. We don't actually need hosts either, switches and routers are the way to go.

theodoxa

pumpkin12345678 wrote: »

I am still totally confused.
ARP (Address resolution protocol) works on Layer 2
Why the hell do you need know the IP address side of things its layer 3

ARP translates an IP Address (Layer 3) to a MAC Address (Layer 2). ARP is used by the device where Layer 3 meets Layer 2 (Firewall, Router, etc...) If it is the first time that IP has been seen, the device will send an ARP request for the MAC Address associated with the IP Address in the packet it received. If the device has already learned the MAC Address, it doesn't need to send an ARP Request. Its only slightly different from how a switch learns MAC addresses, in that it is more proactive. A switch will flood the frame ans wait for the device to send a response allowing it to learn the switchport that the MAC is on. OTOH, a Router/Firewall will broadcast (similar idea to flooding) an ARP Request, which the device with that IP Address will reply to, allowing it to learn the MAC Address.

Just as a switch cannot know how to reach a MAC Address that it has never seen before, a Router/Firewall cannot know what MAC Address is associated with an IP Address which it has never seen before. A Router/Firewall WILL learn IP-MAC Translations and store them in the ARP cache.

pumpkin12345678

Thanks guys, I got the understanding now

Thanks you all

bradl3yC
Your explanation is good. Thanks good luck on your studies

tecnodog7

So lets put it this way. You have a Host which has IP address 192.168.1.12 and mac address: 3333-3333-3333. It needs to go to a web server which has the ip address of 170.1.2.3 but at this point it doesn't know the MAC address. So what will it do. It will use the ARP message and send it to 192.168.1.1 (its' default gateway. THE ROUTER!!!) The router will be like ok so I don't know the end mac address but i know a guy who knows a guy who knows a guy who can get you there.

Suppose your are driving from NY to CA. The guy in ny goes i know a guy in NJ who can get you there so it send you to NJ, and the the NJ guy goes i know a guy in PA who can get you there. So every time there is a next HOP you need to ARP for the mac address. SINCE the IP address never changes.

I hope this helped and sorry if it confused you.