ARP – Understanding ARP Table Entries

arp

I tried to look into different ARP topic but none of them helped me.

It may be a ridiculous question for many of you, please have mercy on a poor noob studying for CCNA 🙂

This been said, here's the question.

I have 2 hosts on 2 different networks separated by 2 routers.

If from "Host A" I ping "Host B", how my ARP table on Host A would look like?

I tried to simulate this on Packet Tracer and the only ARP entries on both hosts is their own gateway IP with the MAC address of the router interface.

I was expecting to find also the remote Host B IP address associated as well with the MAC address of my G0/0 gateway interface.

Am I making any sense at all?

Best Answer

The answer in that image is wrong.

[Edit: image was removed. It had a network like this, with IP and ethernet addresses. The 'answer' showed that after A pings B, A's ARP cache had IP address of B with Router1 Fa0/0's ethernet address.]

                   Fa0/0 Fa0/1    Fa0/0 Fa0/1
A ----- switch ----- Router1 ------ Router2 ------ B

A given operating system could maintain MAC entries for where to send a given IP address, but most do not. The example shows that target Host B is to be sent by ethernet to the ethernet address of Fa0/0, the near side interface of the local gateway. This would work, and perhaps some operating systems do it that way -- they'd have to check the ARP cache before the netmask and routing table. The ones in front of me do not, nor have I ever seen any.

The usual way is that a host maintains a routing table, which for hosts is usually "send everything which isn't local to default gateway"; and for local things only there's also a MAC address table, which says send IP address X to MAC address M. There's an entry in this table for the gateway, which is of course local. IP addresses and their matching MAC addresses get added to the table by ARP, maintained by whatever method the operating system choose, such as using the information from incoming packets, and finally removed from the table by timeouts when no longer required.

To find out what your own hosts do, try

arp -a           # or "show ip arp" on a cisco
ping 8.8.8.8     # or anything not local
arp -a

About ARP in general

MAC addresses are, in general, private to their own local network.

The way to understand what's happening is to consider this:

  • Host A, connected by ethernet to
  • Router RA, connected by telephone company private method to
  • Router RB, connected by super expensive obscure networking technology to
  • Host B

Why would host A know anything at all about the super expensive obscure networking technology on Host B? That's the business of the owners of B. It doesn't even need to know anything about the other side of Router RA.

Or to put it another way, just because Host A has ethernet, and understands ethernet addresses, why should B use ethernet at all. Perhaps it uses PPP over RS-232 -- in which case B has no MAC address at all, in any ARP table anywhere. How would A know? Why would A care? Conversely, Host B running PPP knows about LCP magic numbers, and might have no ethernet software whatsoever. What would it do with Host A's ethernet address? What could A do with B's magic number?

This point is one of the essential reasons why the internet took over the world: the owner of A only has to know how to connect to something which connects to the other things. We don't need to know anything much about them: just the IP address. That means they are free to develop whatever they want, without our computers needing have software that even understands the local addressing methods of the far equipment.

So the answer to the ARP question is this: If this host is using ARP, it maintains MAC addresses of things connected locally, such as this hosts router(s). I know how to put letters in my neighbours' letterboxes, one of my neighbours is a Post Office. When I post a letter to you, I don't know anything at all about how your post office delivers to you.

MAC addresses are a layer 2 concern, and are only for things we are connected to by layer 2. A is only connected by layer 2 to RA, so only has the MAC address of RA and itself.

Related Topic