ARP

Suppose there is a host c receives an ARP request sent from A looking for target B, and suppose C has mapping from B's IP address hardware address in C cache. Should C reply to this request ? pls explain this.

Hi wandy,

as far as i know the way arp works is that it has the destination ip address e.g 192.168.0.1 and it sents out a broadcast to the lan saying 192.168.0.1 send me your mac address.Now other nodes will received that broadcast but only the node containing that ip address will answer.

I agree.

When Host A sends the ARP request and Host C receives it, it will not answer.

Only when Host B will answer to the ARP request since its the machine that Host A is after.

Hey,

Maybe this could help !!!

As for the research over the case i have the following explanation for you.
Any device to communicate on the network sends a packet across with its Mac address and the ip
address to the destination host then the destination host receives the request but stores the Mac
address of the source host and updates its entries in the Arp table. The next time the destination
host tries to send the data packet to the source it looks in its Arp table for the Mac address. The
following example below would be good to provide you a better explanation.

You?ve used TCP/IP or the Internet for any amount of time; you know that workstations on a TCP/IP
network communicate with each other with a TCP/IP address. Over the physical network, however,
workstations communicate with each other with their Media Access Control (MAC) address. Therefore,
the key to communicating via TCP/IP is the mapping of a TCP/IP address to the physical address of a
workstation. An Ethernet Address Resolution Protocol, RFC 826, details the conversion process from a
TCP/IP address to a physical MAC address.
This process is relatively simple. In this example, the TCP/IP workstation 192.42.252.20 is planning
to communicate to 192.42.252.50. To determine the physical address of the destination workstation,
192.42.252.20 sends a network broadcast to every station. This broadcast is seen by every
workstation on the TCP/IP subnet.
The following portion of this initial frame shows the sender's hardware and protocol (TCP/IP)
address, and the target's protocol address. Since the originating station does not know the MAC
address of the destination workstation, the hardware address is all zeros.
ARP:

---

ARP/RARP frame

---

ARP:
ARP: Hardware type = 1 (10Mb Ethernet)
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 6 bytes
ARP: Length of protocol address = 4 bytes
ARP: Opcode 1 (ARP request)
ARP: Sender's hardware address = 080020076A03
ARP: Sender's protocol address = [192.42.252.20]
ARP: Target hardware address = 000000000000
ARP: Target protocol address = [192.42.252.50]
ARP:
ARP: 18 bytes frame padding
ARP:
If the destination station is on the TCP/IP subnet, it will receive this ARP command frame and send
a response frame.
ARP:

---

ARP/RARP frame

---

ARP:
ARP: Hardware type = 1 (10Mb Ethernet)
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 6 bytes
ARP: Length of protocol address = 4 bytes
ARP: Opcode 2 (ARP reply)
ARP: Sender's hardware address = 08002007972C
ARP: Sender's protocol address = [192.42.252.50]
ARP: Target hardware address = 080020076A03
ARP: Target protocol address = [192.42.252.20]
ARP:
ARP: 18 bytes frame padding
ARP:
In this ARP response, the sender has replaced the all zeros hardware address with his MAC address.
The original station, 192.42.252.20, will receive this frame and place the TCP/IP and MAC address of
the 192.42.252.50 station into it's internal ARP table. If these stations need to communicate again,
the workstations will check their internal ARP table before sending the ARP request.
Because workstation TCP/IP addresses can change, the internal ARP table has timeout values. If the
workstations do not communicate to each other, the ARP timeout value will occur and the ARP
information for that single workstation will be removed from the ARP table. If these two stations
must communicate again, another ARP process must occur.
In the following decode, two ARP responses are returned for a single ARP command. In this situation,
more than one station on the network has the same TCP/IP address.

ARP (Address Resolution Protocol) is a layer two protocol that resolves an IP address to a physical
address, also called a Media Access Controller (MAC) address. A host sends an ARP request asking
"Who is this IP?" The device owning the IP should reply with "Hey, I am the one, here's my MAC
address."
Proxy ARP refers to a gateway device, in this case, the firewall, "impersonating" an IP address and
returning its own MAC address to answer an ARP request for another device.

You can also look at the explantion on this site under the Networking menu at routing/ip routing. A picture is worth...

to complete ..

a picture is worth..
a detailed analysis of arp frames

sidd outta curiousity, is that data sniffed and if yes was it preformatted in that text form so you could just paste it ? If yes then what sniffer were you using (I often need to paste sniffed info)

phew all those 'if yes' statements made me feel like a BASIC program flowchart ! hehe

Sahir.

(oh yeah back to topic whoops.. from my tests, even if host C has the address in the ARP cache, it will not respond.. they're very stingy about information sharing.. and just as well.. it would create so much extra traffic)