So that being said, how would traffic flow if device A sends traffic to device C?
So let’s say for example that device A pings device C.
So on host A or device A the command ping 10.1.1.2 is used.
How would traffic flow, now it’s important to remember
that IP is a layer 3 technology.
Mac address are used at layer 2
so PC A needs to have a mapping between the layer 3 IP address
and the layer 2 MAC address
that’s because Ethernet is used in this environment
and the packet needs to be encapsulated at layer 2 and sent unto the wire.
So in Ethernet a MAC address needs to be added at layer 2.
So this point PC A doesn’t know the MAC addresses
associated with IP address 10.1.1.2.
Ethernet once again is a layer 2 technology
and requires the use of MAC addresses when traffic is sent unto Ethernet segment
so before A can send the traffic onto the network segment
it needs to know the MAC address associated with IP address 10.1.1.2
I remember that in the OSI model, each layer is independent of other layers
and lower layers encapsulate higher layers.
So how is PC A going to learn the MAC address of PC C?
it does this by using a protocol called Address Resolution Protocol or ARP,
the first thing PC A does is check its local ARP cache
to see if there is already an existing entry mapping
IP address 10.1.1.2 to a MAC address.
If there isn't an existing entry on the local machines cache
it will send out a broadcast to try and find out
who has IP address 10.1.1.2 and that message is called an ARP request message.
In this example PC A and PC C are in the same subnet
so PC A will send a broadcast unto the local subnet
asking for the MAC address of PC C using an ARP request.
An ARP request looks as follows
The source MAC address in this example is A
because the frame was sent by A
the destination Mac address is a broadcast.
This is because A doesn’t know who has IP address 10.1.1.2
So an ARP request is essentially a message asking who has this IP address?
so the IP address that's being referenced in the packet is 10.1.1.2
the source IP address is 10.1.1.1 the source MAC address is A
and the destination MAC address is a broadcast at the layer 2.
Just to reiterate, this is the layer 2 portion of the message
and this is the layer 3 portion of the message as per the OSI model.
Now before continuing with our example
I wanna show you a real world example of ARP or Address Resolution Protocol.
so on my PC, I can type the command arp-a and I'll see my local ARP cache
my IP address is 10.0.0.3 and as you can see here
I’ve learnt an IP address of 10.0.0.254 dynamically.
there are also some static entries in the ARP cache
as an example this is the broadcast address at layer 3
which is 255.255.255.255 and the layer 2 address is 8Fs
so for a layer 3 broadcast of 255.255.255.255
the equivalent layer 2 address is 8Fs
in this example we only have 1 dynamic MAC address
in the local ARP cache of my pc
so the command ip config shows me my IP addresses.
In this example we can see my IPv6 address which is 2001:20::2
and my IPv4 address of 10.0.0.3
at the moment we're only concentrating on IPv4 addresses.
So you can also see my default gateway, which will set to 10.0.0.254
so my ARP cache is showing the mapping of my default gateways IP address
to the relevant MAC address.
So the command arp - d will allow me to delete the ARP entries in my local ARP cache.
arp - a shows that single dynamic entry, so I'll delete the ARP cache again.
And now you can see that there are no entries in the ARP cache.
I’ll do that again and notice the entry has appeared once again
and that’s because I'm sending traffic from my local PC to my default gateway.
I’ll do that again, so arp - a, shows the directed broadcast address
for this subnet which is 10.0.0.255
I'll now ping another IP address of 10.0.0.123
so there was no ARP entry for this IP address.
But notice when I ping, the ping succeed
and if I look at the ARP cache again,
you’ll notice that an ARP entry has been added for IP added 10.0.0.123
Now this is another IP address configured on my local router.
So the MAC address resolved is the same MAC address
as for IP address 10.0.0.254
If I delete the ARP cache again, so arp - d
notice no entries are found in the ARP cache, still no entry.
Let’s ping 10.0.0.123 the ping succeeds
and if we look at the ARP cache again notice there’s an entry
and the ARP cache now for IP address 10.0.0.123
if I now ping my default gateway of 10.0.0.254
which previously didn’t have entry in the ARP cache
I can now see by using the command arp - a
that an IP address to MAC address entry has been created.
So what's the moral of the story?
Before traffic can be sent to an IP address on the local segment
ARP is required to create a mapping between the layer 3 IP address
and the layer 2 MAC address.
Wireshark is a sniffing tool that allows you to capture traffic
of the local wire to see what’s going on.
It's invaluable tool for Network Engineer
Let's use Wireshark to see what's taking place in this example
So what I'll do firstly is start to capture in Wireshark
So on my Ethernet interface, I'll start capturing frames
I'll now delete the ARP cache
so now no entries are found in the ARP cache
I'll ping 10.0.0.254
and let's look at the ARP cache again
after looking at the ARP cache
we can see that an entry has been added for that address
and I'll now ping 10.0.0.123
so now arp - a shows those 2 entries in the ARP cache
Let's stop the capture and let's look for the ARP entries
So as you can see here is a broadcast that’s been sent from my local device
the protocol used is ARP and I’m asking who has IP address 10.0.0.254
tell 10.0.0.3 my local PC
So at layer 2 you can see that the destination address is a broadcast
the source address is my local machine it’s an ARP request.
This is the Ether type for ARP 0x0806
and looking at the address resolution protocol for ARP information.
Notice we're looking for an IP address 10.0.0.254
the sender MAC address is my local machine
the target MAC address is unknown
and we're looking for IP address 10.0.0.254
Once the device has replied back using an ARP reply message
I'll be able to ping that device.
So in the Wireshark capture you can see I'm sending an echo
so you can see the ICMP echo ping request
and here are I got the response or reply.
Going further down I'll be able to see the ARP request
for IP address 10.0.0.123
the layer 2 destination is a broadcast, the source is a local MAC address
and we're requesting the target MAC address in other words
who has IP address 10.0.0.123
the reply is a unicast because the device are sent
the arp request to knows who the arp request came from.
So the destination at layer 2 is my local machine.
The source is my local router sender the Mac address
sender IP address, target MAC address, target IP address.
In this case I’m communicating directly with my local router
rather than sending traffic through the router
So the MAC address and the IP address used in this example
is my local machine and local router.
You can see in the output here that the sender MAC address is a Cisco router.
IP address is 10.0.0.123
target MAC address is my local laptop
with the target IP address of 10.0.0.3