ARP requests on my net?

Ed Greshko Ed.Greshko at greshko.com
Wed Apr 5 03:42:00 UTC 2006


Mike McCarty wrote:
> Les Mikesell wrote:
>> On Tue, 2006-04-04 at 21:02, Mike McCarty wrote:
>>
>>> >
>>>
>>>> ARP is *only* used to determine MAC addresses.  MAC addresses are
>>>> *only*
>>>> used within a subnet.
>>>
>>> Thank you. I thought I was beginning to lose my mind,
>>> or had completely missed the boat on TCP/IP.
>>
>>
>> TCP works over all kinds of media.  Some kinds are point-to-point
> 
> Yes, AIUI, TCP is layer 4. IP, Frame Relay, SLIP, PPP, etc.
> can form the layer 3.
> 
>> like serial links where whatever you put into one end comes
>> out in only one place at the other.  Ethernet is a broadcast
>> media where all stations on the subnet could see what any of
>> them send, but they don't want to.  The MAC address lets
>> everything that doesn't want your packet ignore it efficiently,
>> and to put the MAC address in the packet the sender must
>> first find the one corresponding to the TCP address via ARP.
> 
> So my Linux machine is asking for router's MAC address so it
> can dump packets destined for the router? 

Ahhh....no.....

It is asking for the MAC address so it can dump packets destined for the
*next hop*.

When it arrives at your router, the router determines that the IP
address in the IP portion of the header is not its IP address.  It will
determine the next hop's MAC address...many different ways to do
this...and send the packet on its way.  This is repeated over and over
until the *destination IP* address is reached.

traceroute www.google.com

will give you an idea of how many times that could happen.


>
> That might make sense
> on a 10 Base 2, yes, because everyone would see all messages
> (that didn't collide, that is :-)  But the message is coming
> from IP, because it knows its own IP address. Why would IP be
> putting layer 2 addresses into messages?
> 
> HTTP, SMTP, FTP, etc.
> TCP
> IP (ICMP)
> LAN/PPP/Frame Relay/ATM or etc.
> physical
> 
> In this case, the LAN protocol is "ethernet", which needs to
> know its own MAC, and that of its gateway. Anything not matching the
> MAC should be dumped. With a semi-intelligent board the board itself
> should dump packets not destined for its MAC. Is it the case that
> layer 1 is asking for its gateway MAC? Somehow, this looks like
> mixed layers to me. It looks like IP is asking for a MAC which
> it doesn't need. Or does IP need the MAC of the destination
> to instruct layer 1 where to send to the gateway? Is it presuming
> that the gateway (router) may have gone down, and another device
> with a different MAC may have taken over, and been assigned the
> same IP via DHCP?
> 
> Mike


-- 
Lonely is a man without love.
		-- Englebert Humperdinck




More information about the users mailing list