ARP Requests – Can a Router Send Them to Hosts?

arplayer2layer3pcaprouter

I play with libpcap in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. I captured arp requests from my router. I don't know if this is a bug of my program, but I was curious (even more after I analyzed the packet and found that the operation code was set to 1 which means we have to do with arp request). Is this ever possible? I didn't found any entry for a similar question on the Internet.

Best Answer

ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 addresses to layer-2 addresses, the same way a PC on a LAN does.

Related Solutions

Router – How hosts will broadcast the arp to Router if there is no default gateway

Say Host A wants to talk to Host B, yet they're in different networks and neither has a route to the other (no specific route or default route.) This generates an immediate error ("Destination Network Unreachable"), with zero network traffic.

If you're doing Proxy ARP, then you do have a default route; the destination is an interface instead of an address. (or your netmask is 0.0.0.0, but I don't think anybody allows that) In this case, an ARP is sent to the all-one's broadcast address (255.255.255.255) and then awaits an answer from anyone on the wire. Presumably, a router on the wire will answer and forward traffic in the correct direction. If not, the request times out and error is generated.

ARP Requests Debugging – How to Debug ARP Requests Over VLAN

I was able to solve the problem. The issue was indeed on the outgoing port as suggested in the comments above. Whatever it's worth a few findings along the way of solving this problem:

first understand the network topology. Nobody can help you before you did that exercise yourself. You cannot ask for punctual help if you don't understand the big picture first
no, there doesn't seem a way to see if an arp packet is sent to a specific interface
on some switches tcpdump didn't show the arp packages. This thread explains that only packets show up that go through the cpu of the switch. This is the case if the packets originate from the switch or are destined for the switch or the advanced tracking is turned on (which was probably my case as the switches where it did show up are running on version 4.15.x of Aristas EOS and the ones which didn't show the arp packages were running 4.12.x)
for debugging vlans it's helpful to set up vlan interfaces along the way. In my case the Arista switch supports setting up an endpoint with an ip address like this:
```
interface Vlan13
  ip address 192.168.42.17/24
```

doing this lets you do e.g. arping 192.168.42.2 -I vlan13 or simply ping 192.168.42.2 (the switch knows that this IP address is configured on vlan 13 and sends the pings over this vlan)

Best Answer

Related Solutions

Router – How hosts will broadcast the arp to Router if there is no default gateway

ARP Requests Debugging – How to Debug ARP Requests Over VLAN

Related Topic