Assume a host is connected to a router. If a host pings an unknown unicast address that's not in host's routing table, which one of the following is going to happen? (Assume the default route points to router interface)
- Host will send ping requests to Default Gateway?
- Host will attempt to resolve Unknown Unicast IP-to-MAC by sending ARP
broadcast? - Anything else?
I tried this on my laptop running Wireshark on wireless NIC and display filters on ARP or ICMP. There's neither ARP request/flood or ping request going out of laptop. Ping fails with "Request timed out" message.
I hope someone can help me understand the behavior.
Best Answer
Every time a hosts needs to send a layer-3 packet on a layer-2 LAN, it must resolve the layer-3 address to a layer-2 address in order to be able to build the layer-2 frame to encapsulate the layer-3 packet. That is what ARP (Address Resolution Protocol) does.
A host will first determine if the destination address is in the same network as the host itself. If it is, then it will look in its ARP table to see if it already has the resolution. ARP tables begin empty, and ARP table entries time out, except for statically defined resolutions. If it finds the entry in its ARP table, then it has the layer-2 address to use to build a frame.
If the layer-3 address is not in the ARP table, the host will send an ARP request to find the layer-2 address. If the target does not respond in a certain time period, the layer-3 packet will be dropped, and an ICMP message saying the host could not be found will be sent to the application.
If the destination layer-3 address is on a different network, the host will use the above procedure to get the layer-2 address of its configured gateway. Most likely, the host already has the layer-3 address and layer-2 resolution in its ARP table, so it doesn't need to send an ARP request, but it will if the entry has timed out.