Why not update ARP cache from incoming (directed) packets - TCP-IP

This is a discussion on Why not update ARP cache from incoming (directed) packets - TCP-IP ; I noticed that at least on Windows only incoming ARP requests appear to update the arp cache. Why not update on other incoming packets? I realize that normally the sender would initially send an ARP request at which point both ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: Why not update ARP cache from incoming (directed) packets

  1. Why not update ARP cache from incoming (directed) packets

    I noticed that at least on Windows only incoming ARP requests appear to
    update the arp cache. Why not update on other incoming packets? I realize
    that normally the sender would initially send an ARP request at which point
    both sides update their cache. If, however, the destination had already aged
    out an address entry it has to do another ARP request before sending a reply
    even though a directed packet from the IP address in question was just
    received.

    Here's what I see if machine A has an entry for B but B doesn't have one for
    A:

    1) A -> B ping req
    2) B broadcasts ARP query for A
    3) A -> B ARP reply
    4) B -> A ping reply
    5) A -> B ping req
    6) B -> A ping reply

    I don't understand why B doesn't update the arp table with information from
    packet A.

    Do other OSes handle this differently?

    Thanks,
    Andrew




  2. Re: Why not update ARP cache from incoming (directed) packets

    andrew queisser wrote:
    > I noticed that at least on Windows only incoming ARP requests appear
    > to update the arp cache. Why not update on other incoming packets?


    It is a question of magnitude. There would (generally) be many orders
    of magnitude more "other incoming packets" than ARP requests from that
    system and it would add unacceptable overhead to the inbound
    processing.

    rick jones
    --
    Wisdom Teeth are impacted, people are affected by the effects of events.
    these opinions are mine, all mine; HP might not want them anyway...
    feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

  3. Re: Why not update ARP cache from incoming (directed) packets

    Hello,

    andrew queisser a écrit :
    > I noticed that at least on Windows only incoming ARP requests appear to
    > update the arp cache. Why not update on other incoming packets?


    Because non ARP packets do not contain any ARP information.
    No, the link layer source (aka MAC or hardware address) address does not
    provide any ARP information. Receiving a packet with given link layer
    and IP source addresses does not mean that packets to this IP address
    are to be sent to this link layer address.

  4. Re: Why not update ARP cache from incoming (directed) packets

    Take the instance of two routers on the same LAN, one is used as a
    default gateway, the second routes to a specific network. If a host on
    the LAN sends a packet to the specific network routed through router
    2, in the absence of any specific routing information it will send the
    packet first to the default gateway router 1. Router 1 knows the route
    is through router 2 and therefore forwards the packet to the LAN
    interface of router 2, this packet has the original IP information but
    has a different hardware source address (router 1's). If router 2
    updated it's arp table based on this forwarded packet it would have an
    incorrect hardware address for the source IP. When a packet comes back
    th other way router 2 will send it to router 1 which will not know
    what to do with it because being a local subnet address it has not
    routing info for it.

    - David Hewison

    On Mar 27, 12:15*am, "andrew queisser" wrote:
    > I noticed that at least on Windows only incoming ARP requests appear to
    > update the arp cache. Why not update on other incoming packets? I realize
    > that normally the sender would initially send an ARP request at which point
    > both sides update their cache. If, however, the destination had already aged
    > out an address entry it has to do another ARP request before sending a reply
    > even though a directed packet from the IP address in question was just
    > received.
    >
    > Here's what I see if machine A has an entry for B but B doesn't have one for
    > A:
    >
    > 1) A -> B ping req
    > 2) B broadcasts ARP query for A
    > 3) A -> B ARP reply
    > 4) B -> A ping reply
    > 5) A -> B ping req
    > 6) B -> A ping reply
    >
    > I don't understand why B doesn't update the arp table with information from
    > packet A.
    >
    > Do other OSes handle this differently?
    >
    > Thanks,
    > Andrew



+ Reply to Thread