A Brief Review of the ARP Question from Last Week
In last week’s post, I compared two sample test questions – a simple one, and a more exam-realistic one. The more realistic question required a deeper knowledge of the topic (ARP), and it required comfortability with several related topics. I was just making a point, but I did list a poll so folks could choose their answers – and there was a high percentage of wrong answers. It seemed like it was worth a quick follow-up, particularly for an explanation of the answers.
Seeing the Forest
You see a question. You think “ARP”. You know ARP: one host sends an ARP broadcast, hoping to learn the other guy’s MAC, and the other guy replies. Simple enough.
When prepping for the CCNA exam, if you read a quick 1 page on ARP in a book, a month ago, and haven’t thought about it since then, you probably won’t be ready to confidently analyze where ARP sits with all its related concepts. Those concepts may be related to what you might see in commands on various devices (show ip arp, arp -a on hosts). It might be the decision of when to use ARP, and when ARP is not needed. ARP matters in the same context as the packet forwarding process, and how routers discard and add data link headers/trailers when they route packets.
How to get that knowledge, and get comfortable? More detailed primary study sources, review questions that are beefier than “what does ARP stand for”, discussions at CLN, etc. But given that my sample question turned into something akin to a classic case of knowledge vs. application, I didn’t want to miss the chance to make the point. whatever you use to prep for the exams, make sure you spend some time thinking about the bigger picture, and how things related to each other. Enough harping – on to the question.
Last week’s question is here, if you’ve not read it. It’s the one with indented answers A – E. I’ve repeated the figure for reference, but the question boils down to this: what happens if all the ARP caches are empty, and host A sends a packet to host C.
How Hosts Think, With Default Gateway
This question assumed that the hosts (A, B, and C) had working IP address, mask, and default gateway setting. (One reader mentioned the different logic with no default gateway, and that was valid, so my apologies for those who considered the no-default-gateway case when answering.) But I’ll play it straight with today’s answers, and stick with the fact that all hosts have IP address, masks, and a gateway setting.
A host bases it’s decision on how to forward packets on a simple decision: is the destination IP address in the same subnet as me, or not. The host uses it’s own IP address and mask to make that same calculation of subnet ID and range of IP addresses that we all know and love from our CCNA prep. Also, note that it’s a local decision; the host doesn’t consult other devices on the same subnet. If host A is sending the packet, it’s host A’s perspective on the range of addresses in the subnet, based on host A’s IP address/mask, not someone else’s. That one reason why basic network troubleshooting requires that you make sure that all the hosts that are supposed to be in the same subnet are indeed in the same subnet.
Sending – same Subnet
If the destination is in the same subnet, then the host can forward the packet directly to the destination host by encapsulating the packet inside an Ethernet frame. That Ethernet frame’s destination MAC address has to be the destination host’s MAC address. The sending host looks in its ARP cache, and if an entry for the destination IP address isn’t there, it uses ARP to find the destination’s MAC address.
When using ARP, the host that needs to send the IP packet sends an ARP Request. That ARP request asks the simple question “If your IP address is X, tell me your MAC address”. The host with IP address X should reply with an ARP Reply message, which lists its IP address and MAC address.
Sending – Different Subnet, Gateway is Set
If the destination is in a different subnet, as was the case in this sample question, and the host has a default gateway setting, the host sends the packet to the default gateway (router). To do so, the sending host encapsulates the IP packet in an Ethernet frame, with the gateway’s MAC address as the destination MAC. that frame crosses the LAN, where the router can deencapsulate, remove the IP packet, and route it on it’s merry way. (I’ve got a new informal video about this on YouTube, www.youtube.com/certskills.)
If the sending host does not have an ARP entry for the gateway’s IP/MAC addresses, the sending host ARP’s, listing the gateway’s IP address in the ARP request, and asking to learn it’s MAC address. The router should send back an ARP Reply.
Hosts Learn MACs from the ARP Request
The obvious part of the ARP process is that the ARP Reply answers the question, listing a host’s MAC address. For example, if host A sends an ARP Request, looking for router R1’s MAC, and R1 sends back an ARP Reply, host A learns R1’s MAC based on that ARP Reply. What’s not so obvious is that R1 also learns host A’s MAC from that original ARP Request.
The ARP Request message itself lists four key fields that matter to this discussion: the sender’s IP address, the sender’s MAC address, the sought-for host’s IP address, and a field for the destination’s MAC address. Of course, the destination’s MAC address is not known at that point, but the message includes the field anyway. When the destination host receives the ARP Request, not only does it send back the ARP Reply, but it learns the IP/MAC of the sending host. Look here for the ARP RFC if you’d like to see more on what’s in the ARP messages. (And another new informal video on these same details at www.youtube.com/certskills.)
Another nice side effect of the ARP Request is that it is a LAN broadcast, sent to the FFFF.FFFF.FFFF destination MAC address. As a result, switches flood the frame, and all hosts in the same subnet receive the ARP Request, and all hosts on the subnet then learn a new entry for their ARP tables.
To the Question!
The distracters (wrong answers) in the question were designed to see if you knew the following two key points:
1) When a host receives an ARP Request, it does not then need to turn around and send an ARP Request looking for the original host, because that original ARP Request listed the IP address/MAC address values.
2) Hosts in one subnet will not ARP for a host in a different subnet, but will instead ARP for their default gateway.
In this case, answer A is incorrect because it states that host A will send an ARP Request looking for host C’s MAC.
Answers B and C are incorrect for the same base reason: host C and router R1 will both have received an ARP Request already, so they do not need to send an ARP Request themselves. Host A sends an ARP Request looking for R1’s MAC, and R1 learns host A’s MAC as a result – so R1 does not need to send an ARP Request looking for host A’s MAC. Similarly, when R2 fowards the IP packet onto the LAN on the right, destined for host C, router R2 will have sent an ARP Request looking for host C’s MAC. Host C will already have learned router R2’s MAC as a result, so host C does not need to send and ARP Request looking for R2’s MAC.
For answer E, it is wrong because routers fo not forward ARP messages. The hosts in the subnet on the left learn ARP entries for hosts in their same subnet only. Because host C sits in a different subnet, neither R1, host A, nor host B would ever learn an ARP table entry for host C.
That’s it. Fire away if you have questions
 | ||||||||
|---|---|---|---|---|---|---|---|---|
|
