Worked examples — ARP — address resolution, ARP cache, gratuitous ARP

Before we begin, one reused mini-picture: the tiny LAN we test everything on.

---

The scenario matrix

The whole space of "what can happen when a host needs a MAC" breaks into these cells. Every worked example below is tagged with the cell(s) it covers.

#	Cell (case class)	What makes it special
C1	Local target, cold cache	Must broadcast a fresh request
C2	Local target, warm cache	Zero packets on the wire — cache hit
C3	Remote target	ARP for the gateway, not the destination
C4	Cache timeout / stale entry	Time-limit edge: entry expires, must re-ARP
C5	Gratuitous ARP — normal announce	Sender IP == Target IP, updates every cache
C6	Gratuitous ARP — duplicate-IP conflict	Someone replies to your own-IP probe
C7	Failover / VIP takeover	MAC behind an IP changes; overwrite the cache
C8	ARP spoofing (the malicious case)	Forged reply poisons the cache → MITM
C9	Degenerate: host ARPs its own IP for data	Loopback shortcut — no frame leaves the NIC
C10	Exam twist: subnet-mask decides local/remote	Same-looking IPs, different subnet decision

---

Worked examples

Example 1 — Local target, cold cache (Cell C1)

Steps

1. A checks its cache for 10.0.0.5. Empty → cannot build the Ethernet frame yet. Why this step? The NIC needs a destination MAC to send anything; A only has the IP, so it must resolve first.
2. A sends an ARP Request as a broadcast. Ethernet dest = FF:FF:FF:FF:FF:FF, source = AA:AA:AA:AA:AA:01. Payload: "Who has 10.0.0.5? Tell 10.0.0.1." Why this step? A doesn't know which MAC owns 10.0.0.5, so it must ask everyone at once — that's what broadcast is for.
3. Switch floods the broadcast to B and C. C sees Target IP 10.0.0.5 ≠ its own 10.0.0.9 → silently discards. B sees a match. Why this step? Only the owner of the target IP is allowed to answer; everyone else ignores it.
4. B sends an ARP Reply as a unicast. Ethernet dest = AA:AA:AA:AA:AA:01, source = BB:BB:BB:BB:BB:05. Payload: "10.0.0.5 is at BB:BB:BB:BB:BB:05." Why this step? B already learned A's MAC from the request's source field, so there is no reason to broadcast — a targeted reply is enough.
5. A caches 10.0.0.5 → BB:BB:BB:BB:BB:05, then sends the real ICMP echo to BB:BB:BB:BB:BB:05.

Count of ARP frames on the wire = 2 (1 broadcast request + 1 unicast reply).

---

Example 2 — Local target, warm cache (Cell C2)

Steps

1. A checks its cache. It finds 10.0.0.5 → BB:BB:BB:BB:BB:05 (learned in Example 1, not yet expired). Why this step? The cache exists precisely so A does not bug the whole LAN every time.
2. A builds the ICMP echo frame directly to BB:BB:BB:BB:BB:05. No ARP needed.

Count of ARP frames = 0.

---

Example 3 — Remote target (Cell C3)

Steps

1. A computes: is 8.8.8.8 local or remote? Apply the mask. A's network = 10.0.0.1 AND 255.255.255.0 = 10.0.0.0. The target's network = 8.8.8.8 AND 255.255.255.0 = 8.8.8.0. 10.0.0.0 ≠ 8.8.8.0 → remote. Why this step? The subnet mask is A's rulebook for deciding whether it can reach a host directly (ARP for it) or must hand off to the default gateway.
2. Because it's remote, A ARPs for the gateway 10.0.0.254, not for 8.8.8.8. Routers do not forward ARP broadcasts, so ARPing for 8.8.8.8 would reach nobody. Why this step? ARP is link-local. The only machine on A's LAN that can carry the packet onward is R.
3. A resolves 10.0.0.254 → EE:EE:EE:EE:EE:FE (broadcast request, unicast reply — same as C1).
4. A sends the data frame with destination MAC = EE:EE:EE:EE:EE:FE (R's MAC) but destination IP = 8.8.8.8. The IP stays the final target; only the MAC is "next hop". Why this step? Layer 2 addresses hop-by-hop (to R), Layer 3 addresses end-to-end (to 8.8.8.8).

---

Example 4 — Cache timeout / stale entry (Cell C4)

Steps

1. t = 0s: cache empty → broadcast (Cell C1). Entry created, expires at 0 + 240 = 240s. Why this step? 4 minutes = 240 seconds; the entry lives until t = 240s.
2. t = 100s: 100 < 240 → entry still valid → cache hit, no broadcast (Cell C2). Why this step? Within the timeout window, ARP stays silent.
3. t = 260s: 260 > 240 → entry already expired → broadcast again. Why this step? Once expired, A has "forgotten" B's MAC and must re-resolve. This is exactly how ARP self-heals if B's NIC was swapped.

Broadcasts happen at pings 1 and 3 (times 0s and 260s). Total = 2.

---

Example 5 — Gratuitous ARP, normal announce (Cell C5)

Steps

1. B builds an ARP with Sender IP = Target IP = 10.0.0.5. Sender MAC = BB:BB:BB:BB:BB:05. Sent to broadcast. Why this step? The defining signature of a gratuitous ARP is Sender IP == Target IP — the host is asking/announcing about its own address. Nobody solicited it.
2. A and C receive it. If they already have an entry for 10.0.0.5, they overwrite it with B's MAC; if not, most stacks simply update if present. Why this step? Gratuitous ARP is proactive — it pushes fresh mapping into everyone's cache instead of waiting to be asked.
3. The switch also refreshes its MAC-learning table entry for port→BB:BB:BB:BB:BB:05 (see Switching & MAC learning tables).

---

Example 6 — Gratuitous ARP, duplicate-IP conflict (Cell C6)

Steps

1. B broadcasts the probe: Sender IP = Target IP = 10.0.0.5, but Sender MAC = B's. Why this step? B is politely asking "is anyone already me?" before committing to the address.
2. X sees Target IP 10.0.0.5 = its own IP → X replies "10.0.0.5 is at XX:XX:XX:XX:XX:99." Why this step? Any legitimate owner of that IP must answer — that is normal ARP behaviour, and here it exposes the clash.
3. B receives a reply to its own-address probe → duplicate IP detected. B logs an error / refuses to use the address (or, with DHCP, may DECLINE and request another). See DHCP. Why this step? A reply proves someone else answers to 10.0.0.5; two machines with one IP would corrupt all delivery, so B must back off.

---

Example 7 — Failover / VIP takeover (Cell C7)

Steps

1. Without gratuitous ARP: clients keep sending to the cached S1. Frames go to a dead NIC and are dropped until each client's entry expires — up to the full 20-minute timeout. Why this step? A cache entry only refreshes when it expires or is overwritten; nothing forces an early refresh here.
2. With gratuitous ARP: Server2 broadcasts "10.0.0.100 is at S2". Every client overwrites 10.0.0.100 → S2 on receipt — a near-instant cutover (well under a second). Why this step? Gratuitous ARP pushes the new mapping, so no one waits for the timeout.

Worst-case downtime: 20 min without, ≈ 0 min with.

---

Example 8 — ARP spoofing / MITM (Cell C8)

Steps

1. M sends an unsolicited ARP Reply claiming the gateway's IP maps to M's MAC. Why this step? ARP has no authentication — a host will accept a reply even without a matching request. That is the whole vulnerability.
2. A overwrites its cache: 10.0.0.254 → MM:MM:MM:MM:MM:66 instead of the real EE:EE:EE:EE:EE:FE. Why this step? A trusts the last ARP reply it saw; there is no way for it to tell truth from lie.
3. A's internet-bound frames now go to M (which forwards them to the real gateway to stay stealthy) → man-in-the-middle.
4. Defence: Dynamic ARP Inspection (DAI), static ARP entry for the gateway, port security. See Network security — MITM & ARP spoofing. Why this step? A static/verified entry cannot be overwritten by a forged reply.

---

Example 9 — Degenerate: host ARPs its own IP for real data (Cell C9)

Steps

1. A checks the destination IP against its own interfaces. 10.0.0.1 is A's own IP. Why this step? Before resolving anything, the stack asks "is this me?" — the cheapest possible check.
2. A routes the packet to the loopback path internally. No Ethernet frame leaves the NIC; no ARP request is generated. Why this step? You never need a hardware address to talk to yourself — the OS delivers it in software.

ARP frames on the wire = 0. Data frames on the wire = 0. (Distinct from Example 2, where 0 ARP frames appear but a real data frame does leave for B.)

---

Example 10 — Exam twist: the mask decides everything (Cell C10)

Steps

1. Mask (a) /24 = 255.255.255.0. A's net = 10.0.0.0; target's net = 10.0.0.130 AND 255.255.255.0 = 10.0.0.0. Equal → local → ARP 10.0.0.130 directly. Why this step? /24 keeps the whole 10.0.0.x range in one subnet, so .1 and .130 are neighbours.
2. Mask (b) /25 = 255.255.255.128. The last octet splits at 128: .0–.127 is one subnet, .128–.255 another. A's net = 10.0.0.1 AND ...128 = 10.0.0.0; target's net = 10.0.0.130 AND ...128 = 10.0.0.128. 10.0.0.0 ≠ 10.0.0.128 → remote → ARP the gateway. Why this step? /25 slices the range in half; now .1 and .130 are in different subnets, so A must route via R.

---

Recall Did every cell get covered?

C1→Ex1, C2→Ex2, C3→Ex3, C4→Ex4, C5→Ex5, C6→Ex6, C7→Ex7, C8→Ex8, C9→Ex9, C10→Ex10. Ten cells, ten examples. ✓