Who's next door?

given
Lessons used	2.1 hubs, switches and routers, 3.1 IP addresses, 3.2 CIDR
Log in	click laptop on the Topology tab (sw1 for the switch, r1 for the router)
Your answers	under the guide, in the lab app

new to this? step by stepbeginner

Click sw1 on the Topology tab. In the sw1 tab: clear mac address-table dynamic.
Click laptop. In the laptop tab: ip neigh flush all, ping -c 3 192.168.1.20 and ip neigh.
Back in the sw1 tab: show mac address-table. Write down the laptop’s and the printer’s ports in Your answers, under the guide.
Challenge: in the laptop tab, ip neigh flush all, ping -c 3 192.168.2.10, ip neigh. Which address, which MAC, which port?
Check task 2.1, under the guide.

From an IP address to a MAC address

A gap in the story

Here’s something the lessons skipped. When the laptop sends to the printer, it knows the printer’s IP address: 192.168.1.20. But on the cable, every frame needs a to MAC address too (lesson 1.1), and that’s what the switch reads (lesson 2.1). Nobody typed the printer’s MAC address into the laptop. So how does the laptop know it?

It asks.

ARP: asking the room

Think of a classroom on the first day. You know someone called Sam is in your class, but not which face is Sam’s. So you ask the whole room: “Which one of you is Sam?” Sam puts a hand up and says “Me!”, and now you know who to pass your note to. You remember, so you don’t have to ask again tomorrow.

Computers do the same, with ARP, the Address Resolution Protocol. (Resolution here means working out: working out a MAC address from an IP address.)

The laptop shouts a broadcast to everyone on its network, to the MAC address ff:ff:ff:ff:ff:ff: “Who has 192.168.1.20? Tell 192.168.1.50.”
Every host hears it, and only the printer answers, just to the laptop: “192.168.1.20 is at aa:aa:aa:22:22:22.”
The laptop writes that down, and sends its frames to aa:aa:aa:22:22:22.

It’s the same shout, then whisper pattern as DHCP in lesson 4.1.

in one sentence ARP asks everyone on the network who has this IP address?, and the one that has it answers with its MAC address.

The neighbour table

The laptop keeps the answers in a list, so it doesn’t have to shout before every frame. Linux calls it the neighbour table (a neighbour is another host on your own network: next door). Older books call it the ARP cache or ARP table. Each entry is an IP address, the MAC address that goes with it, and a state:

State	What it means
`REACHABLE`	it answered just now: trust it
`STALE`	it’s been a while. Keep using it, but check it again next time
`INCOMPLETE` / `FAILED`	it asked, and nobody answered (task 2.2)

in one sentence The neighbour table is the host’s list of this IP address is at that MAC address, for its own network.

What about hosts on other networks?

ARP is a shout, and shouts stop at the router (lesson 2.2). So the laptop can only ARP for hosts on its own network. For anything else it uses the rule from lesson 3.2: different network, so send it to the gateway. Which means the frame needs the gateway’s MAC address, not the faraway host’s. Keep that in mind for the challenge.

The switch doesn’t need ARP

The switch never asks anyone anything. It learns by watching the from MAC address of every frame that comes in, and writes down which port it came from: its MAC address table, from lesson 2.1. So after the laptop and the printer have talked, the switch knows both their ports.

2 show

Three tables

On the laptop, ip neigh (short for neighbour) prints the neighbour table:

laptop:~# ip neigh
192.168.1.20 dev eth1 lladdr aa:aa:aa:22:22:22 REACHABLE

Part	What it means
`192.168.1.20`	the neighbour’s IP address
`dev eth1`	it’s out of this card
`lladdr aa:aa:aa:22:22:22`	its MAC address (lladdr: link-layer address, layer 2)
`REACHABLE`	the state

arp -n prints the same table the old way, with headings. Both are common, so it’s worth knowing both:

laptop:~# arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.20             ether   aa:aa:aa:22:22:22   C                     eth1

On the switch, show mac address-table:

sw1#show mac address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    aaaa.aa11.1111    DYNAMIC     Gi2
   1    aaaa.aa22.2222    DYNAMIC     Gi3
   1    aaaa.aa33.3333    DYNAMIC     Gi4
   1    aac1.ab49.a6ba    DYNAMIC     Gi1

Column	What it means
`Vlan`	which network inside the switch. All four ports are in VLAN 1 here, one network
`Mac Address`	a MAC address it has seen, in the switch’s dotted style
`Type`	`DYNAMIC`: learned from a frame, not typed in by hand
`Ports`	the port it was seen on. `Gi2` is short for `GigabitEthernet2`, port 2

The last entry is r1. The switch and router MAC addresses in this lab are made up fresh every time the lab starts, so yours will be different from the one here.

And the router has a table just like the laptop’s. On r1, show ip arp:

r1#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.1              -  aac1.ab49.a6ba  ARPA   GigabitEthernet1
Internet  192.168.1.50             0  aaaa.aa11.1111  ARPA   GigabitEthernet1

A - in the age column means it’s the router’s own address. 0 means it learned this one less than a minute ago.

3 follow along

Watch ARP fill the table

Start with empty tables, so you can watch both fill up. The switch first: click sw1 on the Topology tab. In the sw1 tab:
run in the sw1 tab
```
clear mac address-table dynamic
show mac address-table
```
clear mac address-table dynamic forgets every address the switch learned. It prints nothing, and the table under the headings is empty. (A switch soon learns everything again, so clearing it is harmless; it’s a normal step when you’re chasing a fault.)
Now the laptop. Click laptop on the Topology tab, and in the laptop tab empty its neighbour table:
run in the laptop tab
```
ip neigh flush all
ip neigh
```
flush all empties it. The second command prints nothing: the laptop doesn’t know anyone’s MAC address now.
Send the printer three pings:
run in the laptop tab
```
ping -c 3 192.168.1.20
```
Ping sends a small are you there? message and waits for the answer. -c 3 means three times, then stop. Each answer line ends with how long the round trip took, in milliseconds. Before the first one could go, the laptop had to ARP for the printer.
Look again:
run in the laptop tab
```
ip neigh
arp -n
```
The printer’s IP address and MAC address are there now. Wait a minute and run ip neigh again: it changes to STALE. You may also see 192.168.1.1 turn up: r1 asked about the laptop, and the laptop wrote r1 down from the question.
Switch to the sw1 tab and look at the switch again:
run in the sw1 tab
```
show mac address-table
```
Two entries now: aaaa.aa11.1111 (the laptop) and aaaa.aa22.2222 (the printer). The switch learned each one from the from address of a frame: the laptop’s ARP question and pings, and the printer’s answers. Which port is each on?
Fill in the follow-along answers in Your answers, under the guide:
editYour answersunder the guide
```
The laptop's port on sw1: Gi2
The printer's port on sw1: Gi3
```

in one sentence ip neigh shows what the laptop learned with ARP; show mac address-table shows what the switch learned by watching.

4 challenge

Pinging further away

Now ping web, 192.168.2.10, from the laptop. It’s on another network, two routers away.

Before you look, guess: after the ping, which IP address will be in the laptop’s neighbour table? Then empty the table, ping, and see. Fill in the challenge answers in Your answers:

web_neighbor_ip: the IP address that appears in the neighbour table;
web_neighbor_mac: the MAC address that goes with it;
r1_port: the port on sw1 where that MAC address is.

hint

In the laptop tab: ip neigh flush all, then ping -c 3 192.168.2.10, then ip neigh.

hint

Is 192.168.2.10 on the laptop’s network, 192.168.1.0/24? If not, the laptop doesn’t send the frame to web at all. It sends it to someone else. ip route says who.

hint

To check the MAC address from the router’s side: click r1 on the Topology tab, and in the r1 tab run show interfaces GigabitEthernet1 says address is .... Then find that address in sw1’s show mac address-table.

show the solutionYour answers

or let the lab do it: Solve it for me, next to Check task, does the task and fills in the answers, printing every step

The address the laptop asked ARP about, to reach web: 192.168.1.1
The MAC address it learned for it: aa:c1:ab:49:a6:ba      # yours is different: r1's MAC address
r1's port on sw1: Gi1

192.168.2.10 isn’t in the laptop’s neighbour table, and never will be. web is on another network, so the laptop sends every frame for web to its gateway, r1, and ARPs for r1’s MAC address instead. r1 takes it from there, with a new frame for the next network.

That’s the rule from lesson 3.1, seen on a real computer: the IP address says web the whole way, but the MAC address only ever says the next stop.

objective

From an IP address to a MAC address

A gap in the story

ARP: asking the room

The neighbour table

What about hosts on other networks?

The switch doesn’t need ARP

Three tables

Watch ARP fill the table

Pinging further away

5 check: run it, then prove it