Topic 7 – ARP, Broadcast Containment, and Router Gateways

MAC and IP Addressing Fundamentals

  • Every NIC on an Ethernet LAN possesses two primary identifiers:

    • Physical / Layer-2 address (MAC) – 48-bit hexadecimal value burned into the NIC, used for NIC→NICNIC \rightarrow NIC delivery inside the same broadcast domain.

    • Logical / Layer-3 address (IP) – 32-bit IPv4 (or 128-bit IPv6) value, used to locate the host across internetworks.

  • Role separation:

    • Layer-3 IP decides where the packet must ultimately go (same network or remote network).

    • Layer-2 MAC decides how to reach the next NIC on the current link.

  • If the destination IP is local, the frame’s destination MAC equals the target host’s MAC. If the destination IP is remote, the frame’s destination MAC equals the default-gateway’s MAC.

Frame Construction – Destination on the Same Network

  • Example scenario:

    • PC1 IP=192.168.10.10\text{IP}=192.168.10.10, MAC=aa−aa−aa\text{MAC}=aa-aa-aa .

    • PC2 IP=192.168.10.11\text{IP}=192.168.10.11, MAC=55−55−55.</p></li></ul></li><li><p>PC1encapsulatesthepacket:</p><ul><li><p>Layer−3header</p></li><li><p>SourceIP\text{MAC}=55-55-55 .</p></li></ul></li><li><p>PC1 encapsulates the packet:</p><ul><li><p>Layer-3 header</p></li><li><p>Source IP=192.168.10.10</p></li><li><p>DestinationIP</p></li><li><p>Destination IP=192.168.10.11</p></li><li><p>Layer−2(Ethernet)header</p></li><li><p>DestinationMAC</p></li><li><p>Layer-2 (Ethernet) header</p></li><li><p>Destination MAC=55! -! 55! -! 55</p></li><li><p>SourceMAC</p></li><li><p>Source MAC=aa! -! aa! -! aa</p></li></ul></li></ul><h3id="5fb8a0f4−9fda−48c4−aaae−c37d067f8ae3"data−toc−id="5fb8a0f4−9fda−48c4−aaae−c37d067f8ae3"collapsed="false"seolevelmigrated="true">FrameConstruction–DestinationonaRemoteNetwork</h3><ul><li><p>WhentheIPdestinationliesoutsidethelocalnetwork,thesendermustreacha<strong>routerinterface(defaultgateway)</strong>first.</p></li><li><p>Stepsalongthepath(PC1→R1→R2→PC2):</p><ol><li><p>PC1buildsaframewith<strong>dest−MAC=R1G0/0/0</strong>.</p></li><li><p>R1de−encapsulates,consultsitsroutingtable,re−encapsulatestowardR2with</p></li></ol><ul><li><p>SourceMAC</p></li></ul></li></ul><h3 id="5fb8a0f4-9fda-48c4-aaae-c37d067f8ae3" data-toc-id="5fb8a0f4-9fda-48c4-aaae-c37d067f8ae3" collapsed="false" seolevelmigrated="true">Frame Construction – Destination on a Remote Network</h3><ul><li><p>When the IP destination lies outside the local network, the sender must reach a <strong>router interface (default gateway)</strong> first.</p></li><li><p>Steps along the path (PC1 → R1 → R2 → PC2):</p><ol><li><p>PC1 builds a frame with <strong>dest-MAC = R1 G0/0/0</strong>.</p></li><li><p>R1 de-encapsulates, consults its routing table, re-encapsulates toward R2 with</p></li></ol><ul><li><p>Source MAC=\text{R1 G0/0/1}</p></li><li><p>DestMAC</p></li><li><p>Dest MAC=\text{R2 G0/0/1}

    1. Final hop: R2 delivers with dest-MAC = PC2’s NIC.

  • Across every link the same IP packet travels inside a new Layer-2 frame that matches that medium (e.g., Ethernet, serial, MPLS …).

  • Address–mapping mechanisms:

    • IPv4 → ARP (Address Resolution Protocol).

    • IPv6 → ICMPv6 Neighbor Discovery (ND).

Broadcast Domains & Containment

  • Broadcast domain = set of NICs that receive every Layer-2 broadcast.

  • Switches forward broadcasts out all ports (except ingress) ⇒ overall LAN ≈ one broadcast domain.

  • Implications:

    • Each host must process every broadcast; excessive hosts ⇒ performance degradation.

    • Solution: segment the LAN using routers (or Layer-3 switches/VLANs) to create multiple smaller broadcast domains.

Access-Layer Communication Problem

  • Applications know IP destinations, not MACs.

  • Sender needs to translate destination IP → MAC; uses ARP (IPv4) or ND (IPv6).

ARP (Address Resolution Protocol) – Overview

  • Purpose: map IPv4 ↔ MAC and cache the mapping.

  • Operates directly over Ethernet (Ethertype 0x0806).</p></li><li><p>Twokeyfunctions:</p><ol><li><p><strong>Resolve</strong>unknownMACaddresses.</p></li><li><p><strong>Maintain</strong>anARPtable/cacheofrecentmappings.</p></li></ol></li></ul><h4id="055555a0−1876−411a−9b95−7a154dbbce02"data−toc−id="055555a0−1876−411a−9b95−7a154dbbce02"collapsed="false"seolevelmigrated="true">ARPTable(Cache)</h4><ul><li><p>StoredinRAM;eachentrybinds</p><ul><li><p>IPv4address⇔MACaddress</p></li><li><p>Time−stamp(dynamicentriesexpire).</p></li></ul></li><li><p>Lookuplogicwhenpreparingtotransmit:</p><ul><li><p>Ifdest−IPis<em>local</em>→searchforthatIP.</p></li><li><p>Ifdest−IPis<em>remote</em>→searchfordefault−gateway’sIP.</p></li><li><p>Hit⇒usecachedMAC.</p></li><li><p>Miss⇒initiateARPRequest.</p></li></ul></li><li><p>Entrylifetimes(exampleforWindows10):).</p></li><li><p>Two key functions:</p><ol><li><p><strong>Resolve</strong> unknown MAC addresses.</p></li><li><p><strong>Maintain</strong> an ARP table/cache of recent mappings.</p></li></ol></li></ul><h4 id="055555a0-1876-411a-9b95-7a154dbbce02" data-toc-id="055555a0-1876-411a-9b95-7a154dbbce02" collapsed="false" seolevelmigrated="true">ARP Table (Cache)</h4><ul><li><p>Stored in RAM; each entry binds</p><ul><li><p>IPv4 address ⇔ MAC address</p></li><li><p>Time-stamp (dynamic entries expire).</p></li></ul></li><li><p>Lookup logic when preparing to transmit:</p><ul><li><p>If dest-IP is <em>local</em> → search for that IP.</p></li><li><p>If dest-IP is <em>remote</em> → search for default-gateway’s IP.</p></li><li><p>Hit ⇒ use cached MAC.</p></li><li><p>Miss ⇒ initiate ARP Request.</p></li></ul></li><li><p>Entry lifetimes (example for Windows 10):15\text{–}45seconds.</p></li><li><p>Manualcachemanagement:commandssuchasseconds.</p></li><li><p>Manual cache management: commands such asarp\ -d(Windows)or(Windows) orclear\ arp\ cache(Cisco)removeentries.</p></li></ul><h4id="5750ea6d−0650−4ddb−bf3e−a0e3a101bbfd"data−toc−id="5750ea6d−0650−4ddb−bf3e−a0e3a101bbfd"collapsed="false"seolevelmigrated="true">ARPRequest(Broadcast)</h4><ul><li><p>SenderconstructsEthernetframe:</p><ul><li><p>Dest−MAC(Cisco) remove entries.</p></li></ul><h4 id="5750ea6d-0650-4ddb-bf3e-a0e3a101bbfd" data-toc-id="5750ea6d-0650-4ddb-bf3e-a0e3a101bbfd" collapsed="false" seolevelmigrated="true">ARP Request (Broadcast)</h4><ul><li><p>Sender constructs Ethernet frame:</p><ul><li><p>Dest-MAC=FF! -! FF! -! FF! -! FF! -! FF! -! FF(broadcast).</p></li><li><p>Src−MAC(broadcast).</p></li><li><p>Src-MAC=\text{sender’s MAC}.</p></li><li><p>Ethertype.</p></li><li><p>Ethertype=0x0806.</p></li><li><p>Payloadasks:“Whohas.</p></li><li><p>Payload asks: “Who has\text{IPv4}=X?Tell? Tell\text{MAC}=Y.”</p></li></ul></li><li><p>Switchfloodsrequest;everyNICexaminesthepayloadIP.</p></li></ul><h4id="7ffd2140−ad52−40ba−af59−aa9b58951eb0"data−toc−id="7ffd2140−ad52−40ba−af59−aa9b58951eb0"collapsed="false"seolevelmigrated="true">ARPReply(Unicast)</h4><ul><li><p>OnlytheNICwithmatchingIPresponds:</p><ul><li><p>Dest−MAC.”</p></li></ul></li><li><p>Switch floods request; every NIC examines the payload IP.</p></li></ul><h4 id="7ffd2140-ad52-40ba-af59-aa9b58951eb0" data-toc-id="7ffd2140-ad52-40ba-af59-aa9b58951eb0" collapsed="false" seolevelmigrated="true">ARP Reply (Unicast)</h4><ul><li><p>Only the NIC with matching IP responds:</p><ul><li><p>Dest-MAC=\text{Requestor’s MAC}</p></li><li><p>Src−MAC</p></li><li><p>Src-MAC=\text{Responder’s MAC}</p></li><li><p>Ethertype</p></li><li><p>Ethertype=0x0806

  • Requestor updates ARP table; subsequent frames become unicast.

  • If no reply ⇒ original packet is discarded (cannot build frame).

  • Static ARP entries possible; never age out (rare in practice).

    • ARP in Remote Communications

    • When dest-IP is remote, host repeats the same ARP logic but targets the default-gateway’s IP.

    • Ensures first hop frame reaches the router; routers then forward at Layer-3.

    ARP Troubles & Security

    • Broadcast overhead: surge when many devices boot simultaneously; normal business traffic incurs minimal impact.

    • ARP spoofing / poisoning:

      • Threat actor replies with its own MAC for a victim IP (e.g., default gateway).

      • Victim hosts update their ARP tables with the rogue mapping ⇒ traffic interception.

      • Mitigation: Dynamic ARP Inspection (DAI), port security, static ARP for critical devices.

    Viewing the ARP Table

    • Cisco IOS: show\ ip\ arp</p></li><li><p>Windows10:</p></li><li><p>Windows 10:arp\ -a (lists dynamic & static entries).

    Routers as Gateways & Network Boundaries

    • Router interface = boundary between two networks / broadcast domains.

    • Each interface possesses:

      • Unique MAC (if Ethernet-capable).

      • IP address identifying the directly-connected network.

    • Hosts configure a default gateway equal to the router’s local-LAN IP.

      • Manual (static) or automatic via DHCP.

    Home / SOHO Wireless Routers

    • Factory-default: act as DHCP server for the inside network.

      • Hand out:

      • Host IPv4 address

      • Subnet mask

      • Default gateway (router’s own LAN IP)

    • Typical addressing:

      • Router LAN IP = first usable host address (e.g., 192.168.0.1).

      • DHCP pool allocates within the same /24.

    • ISP side (WAN interface):

      • Router behaves as DHCP client; ISP supplies a public, internet-routable IPv4.

    • Therefore the wireless router forms the demarcation between:

      • Internal / private network – protected, non-routable.

      • External / public internet – routable, potentially untrusted.

    Importance of the Gateway

    • All hosts on a LAN must forward off-net traffic to this gateway ⇒ connectivity to other subnets & Internet.

    • Loss of correct gateway IP or MAC (e.g., via ARP spoofing) disrupts all external communication.

    Key Numbers, Terms, and Commands Summary

    • Broadcast MAC: FF! -! FF! -! FF! -! FF! -! FF! -! FF</p></li><li><p>Examplehostaddresses:</p></li><li><p>Example host addresses:192.168.10.10 \rightarrow aa! -! aa! -! aa,,192.168.10.11 \rightarrow 55! -! 55! -! 55</p></li><li><p>EthertypeforARP:</p></li><li><p>Ethertype for ARP:0x0806</p></li><li><p>ARPcachelifetime(Windows10):</p></li><li><p>ARP cache lifetime (Windows 10):15\text{–}45seconds.</p></li><li><p>CLI:</p><ul><li><p>Cisco:seconds.</p></li><li><p>CLI:</p><ul><li><p>Cisco:show\ ip\ arp,,clear\ arp</p></li><li><p>Windows:</p></li><li><p>Windows:arp\ -a,,arp\ -d$$

  • Security mitigation: Dynamic ARP Inspection (DAI).

    • Conceptual Connections & Real-World Relevance

    • ARP underpins all IPv4 over Ethernet traffic; failure or compromise affects every upper-layer protocol (HTTP, SSH, etc.).

    • Broadcast containment via routers/VLANs parallels scalability and security design principles.

    • Default-gateway logic embodies the hierarchical nature of internetworking (edge → distribution → core).

    • ARP spoofing illustrates the need for layered defense: switch-level protections + upper-layer encryption (HTTPS, SSH) to guard against MITM attacks.