Re: Newbie question... Firewalls vs cisco routers - Proxy arp versus directly connected networks...

On 7/11/05, chip <chip.gwyn@gmail.com> wrote:

> Let's say everything was just turned on, no arp table exists yet.  Now
> when the router attempts to talk to a host (192.168.0.10) it will
> first send out an ARP request to the broadcast address of the network.
>  If your network is 192.168.0.0/24 then the request is sent to
> 192.168.0.255 (the broadcast).

Are you *sure* about this Chip?  It's been years since I've looked at
the RFC for ARP, but it seems to me that it would be rather bizarre
for the router to send a layer 3 message to solve a layer 2 problem. 
What I thought it should be doing is sending out an arp query to the
broadcast ethernet (not IPv4) address, which is FF:FF:FF:FF:FF:FF, and
with a quick invocation of tcpdump it seems that I'm at least correct
in some cases...

12:55:21.096374 00:0a:e6:c4:eb:fe > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: arp who-has 192.168.2.39 tell 192.168.2.1
12:55:22.093988 00:0a:e6:c4:eb:fe > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: arp who-has 192.168.2.39 tell 192.168.2.1
12:55:23.093989 00:0a:e6:c4:eb:fe > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: arp who-has 192.168.2.39 tell 192.168.2.1

The rest of your post is correct, excepting that they don't *always*
have to be on the same IPv4 network when they're on the same logical
segment.  Strange and terrible things may happen if they're not
(mysterious packet duplication and other topological abominations) but
they will, under certain circumstances, communicate even without a
static route on both hosts.