0

When a network device updates its MAC table, what protocol is being called?

I am pretty sure it is ARP, but correct me if I am wrong!

What messages are being sent and from whom, what information is being exchanged, and why?

Improve this question
1
  • 1
    It depends what exactly you mean by "network device". Could it be that you confuse the MAC table (layer 2) with the ARP table (layer 3)? (see answer for more details)
    – Albin
    Commented Oct 4, 2020 at 12:34

2 Answers 2

Reset to default
3

It depends what exactly you mean by "network device". Could it be that you confuse the MAC table (layer 2) with the ARP table (layer 3)?

Usually if you talk about MAC tables you are referring to switches. If a switch doesn't know the destination MAC address (no entry in the MAC table) it will send out a frame on all ports (except the source port) acting like a hub, but this "discovery" is not ARP. In fact it's not a "discovery" at all, the switch does not learn the destination MAC until it receives a frame from that device.

The ARP protocol or subsequently the ARP table is used to resolve an IP address to the corresponding MAC address. For example if my PC's NIC has the IP 192.168.0.100/24 and I want to ping 192.168.0.101/24 the ARP table (not the MAC table) will be used to check the corresponding MAC address.

If the table does not have an entry for this IP the ARP protocol is used to "discover" the corresponding MAC address. For that an ARP request (that includes the target IP address as well as the source MAC and source IP) is send out to the broadcast MAC address (ff-ff-ff-ff-ff-ff), the switch will send the request to all active ports. If a device connected to the switch recognizes the target IP as it's own IP address it will send back an ARP response with it's MAC address back to the source IP/MAC.

Note1: the frames arriving at the switch from ARP request and response will be used to populate the switch's MAC table.

Note2: Unless we are talking about level 3 switches, those use ARP as well.

Improve this answer
0

Yes, you are right that's ARP.

ARP stands for Address Resolution Protocol. When you try to ping an IP address on your local network, say 192.168.1.1, your system has to turn the IP address 192.168.1.1 into a MAC address. This involves using ARP to resolve the address, hence its name.

Systems keep an ARP look-up table where they store information about what IP addresses are associated with what MAC addresses. When trying to send a packet to an IP address, the system will first consult this table to see if it already knows the MAC address. If there is a value cached, ARP is not used.

If the IP address is not found in the ARP table, the system will then send a broadcast packet to the network using the ARP protocol to ask "who has 192.168.1.1". Because it is a broadcast packet, it is sent to a special MAC address that causes all machines on the network to receive it. Any machine with the requested IP address will reply with an ARP packet that says "I am 192.168.1.1", and this includes the MAC address which can receive packets for that IP.

Source: https://www.tummy.com/articles/networking-basics-how-arp-works/

Improve this answer
1
  • ARP is not used to populate the MAC table, it is used to populate the ARP table!
    – Albin
    Commented Oct 3, 2020 at 21:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .