question about ARP

[k.oyama]

Hello,

I have a question about ARP-cache mechanism on a cisco router.

[ PCa ] [ PCb ]

| |

----+---+----+---

| e0

*---*

| R |

*---*

I saw the following behavior on cisco2600 and 3640 (IOS: 12.1.x).

But, is there any difference between IOS versions (e.g. 10.x)?

Router's ARP cache is written, when

PC sends ARP request to Router

or

Router sends ARP request to PC, and gets reply from PC

Router's ARP cache is erased, when

timer age out

or

link goes down on connected interface (e0)

Router's ARP cache is refleshed, when

clear arp command entered (then ARP requests will be send to the IP addresses on ARP table, to reflesh the table)

or

every time the PC (IP addresses on router's ARP table) sends ARP request, regardless of it's desitination.

(e.g. PCa --> PCb or PCa --> Router)

thanks.

[lgijssel]

ARP is a standard part of the IP protocol suite. The behaviour of the router will not be that much different for whatever IOS release.

I have two remarks regarding your observations:

- When the router sees a packet from the PC (or other node) it examines the source-adress and updates the cache with it. The ARP cache is updated when a PC sends an IP packet to a destination beyond the routers LAN interface.

This does not need to be an ARP request. It can be any IP packet. In practice the first packet mostly is an ARP-request because the ARP max-age on a PC is much shorter than on the router.

-Two PC's communicating on the same subnet does not update the routers ARPcache.

Regards,

Leo

[darrenj]

I disagree. I was under the impression that when a device receives an ARP request for an IP address that is already in it's ARP cache, the device will update it's ARP cache with the sender's MAC address. This is known as a 'gratuitous ARP' and happens on routers. If you change the MAC address on a Cisco router, the router sends a gratuitous ARP so that the end devices update their ARP cahce with the new MAC address.

This must therefore mean a device receiving an ARP request, would update its cache with the senders IP and MAC??

Darren.

[t.baranski]

I believe Darren's post reflects the standard behavior for ARP implementations these days. I've run into situations where a device didn't seem to be behaving properly in this regard (e.g., ignoring gratuitous ARPs), but for the most part I believe you'll find that devices update their ARP caches as per above.

[k.oyama]

Leo,

>- When the router sees a packet from the PC (or other node) it examines the

> source-adress and updates the cache with it. The ARP cache is updated when a

>PC sends an IP packet to a destination beyond the routers LAN interface.

>This does not need to be an ARP request. It can be any IP packet. In practice

>the first packet mostly is an ARP-request because the ARP max-age on a PC is

>much shorter than on the router.

I thought what you commented like the case bellow.

Am I right?

Thanks.

*************************************************

[ PCa ]---(hub)-----{ Router ]

IP1 IP2

Now, an ARP table on Router is

IPadd Hardware

----- --------

IP1 PCa

Then, I swap PCa to PCb

On PCb, Router's hardware address is statcally written in its ARP table.

(PCb do not need to send ARP request to know the router's hardware address)

[ PCb ]---(hub)-----{ Router ]

IP1 IP2

If PCb sends IP packet to Router, then the router's ARP table will be refleshed.

Because Router sees the source mac address in the ethernet header, and thinks it is

differnt from the address cached (PCa) ?

ARP teble on Router

IPadd Hardware

------ ------------

IP1 PCa

---> Router receives an IP (not ARP) packet destined for it from PCb. -->

IPadd Hardware

------ ------------

IP1 PCb

*************************************************