Original subtitles

So that being said, how would traffic flow if device A sends traffic to device C?

So let�s say for example that device A pings device C.

So on host A or device A the command ping 10.1.1.2 is used.

How would traffic flow, now it�s important to remember

that IP is a layer 3 technology.

Mac address are used at layer 2

so PC A needs to have a mapping between the layer 3 IP address

and the layer 2 MAC address

that�s because Ethernet is used in this environment 10

and the packet needs to be encapsulated at layer 2 and sent unto the wire. 11

So in Ethernet a MAC address needs to be added at layer 2. 12

So this point PC A doesn�t know the MAC addresses 13

associated with IP address 10.1.1.2. 14

Ethernet once again is a layer 2 technology 15

and requires the use of MAC addresses when traffic is sent unto Ethernet segment 16

so before A can send the traffic onto the network segment 17

it needs to know the MAC address associated with IP address 10.1.1.2 18

I remember that in the OSI model, each layer is independent of other layers 19

and lower layers encapsulate higher layers. 20

So how is PC A going to learn the MAC address of PC C? 21

it does this by using a protocol called Address Resolution Protocol or ARP, 22

the first thing PC A does is check its local ARP cache 23

to see if there is already an existing entry mapping 24

IP address 10.1.1.2 to a MAC address. 25

If there isn't an existing entry on the local machines cache 26

it will send out a broadcast to try and find out 27

who has IP address 10.1.1.2 and that message is called an ARP request message. 28

In this example PC A and PC C are in the same subnet 29

so PC A will send a broadcast unto the local subnet 30

asking for the MAC address of PC C using an ARP request. 31

An ARP request looks as follows 32

The source MAC address in this example is A 33

because the frame was sent by A 34

the destination Mac address is a broadcast. 35

This is because A doesn�t know who has IP address 10.1.1.2 36

So an ARP request is essentially a message asking who has this IP address? 37

so the IP address that's being referenced in the packet is 10.1.1.2 38

the source IP address is 10.1.1.1 the source MAC address is A 39

and the destination MAC address is a broadcast at the layer 2. 40

Just to reiterate, this is the layer 2 portion of the message 41

and this is the layer 3 portion of the message as per the OSI model. 42

Now before continuing with our example 43

I wanna show you a real world example of ARP or Address Resolution Protocol. 44

so on my PC, I can type the command arp-a and I'll see my local ARP cache 45

my IP address is 10.0.0.3 and as you can see here 46

I�ve learnt an IP address of 10.0.0.254 dynamically. 47

there are also some static entries in the ARP cache 48

as an example this is the broadcast address at layer 3 49

which is 255.255.255.255 and the layer 2 address is 8Fs 50

so for a layer 3 broadcast of 255.255.255.255 51

the equivalent layer 2 address is 8Fs 52

in this example we only have 1 dynamic MAC address 53

in the local ARP cache of my pc 54

so the command ip config shows me my IP addresses. 55

In this example we can see my IPv6 address which is 2001:20::2 56

and my IPv4 address of 10.0.0.3 57

at the moment we're only concentrating on IPv4 addresses. 58

So you can also see my default gateway, which will set to 10.0.0.254 59

so my ARP cache is showing the mapping of my default gateways IP address 60

to the relevant MAC address. 61

So the command arp - d will allow me to delete the ARP entries in my local ARP cache. 62

arp - a shows that single dynamic entry, so I'll delete the ARP cache again. 63

And now you can see that there are no entries in the ARP cache. 64

I�ll do that again and notice the entry has appeared once again 65

and that�s because I'm sending traffic from my local PC to my default gateway. 66

I�ll do that again, so arp - a, shows the directed broadcast address 67

for this subnet which is 10.0.0.255 68

I'll now ping another IP address of 10.0.0.123 69

so there was no ARP entry for this IP address. 70

But notice when I ping, the ping succeed 71

and if I look at the ARP cache again, 72

you�ll notice that an ARP entry has been added for IP added 10.0.0.123 73

Now this is another IP address configured on my local router. 74

So the MAC address resolved is the same MAC address 75

as for IP address 10.0.0.254 76

If I delete the ARP cache again, so arp - d 77

notice no entries are found in the ARP cache, still no entry. 78

Let�s ping 10.0.0.123 the ping succeeds 79

and if we look at the ARP cache again notice there�s an entry 80

and the ARP cache now for IP address 10.0.0.123 81

if I now ping my default gateway of 10.0.0.254 82

which previously didn�t have entry in the ARP cache 83

I can now see by using the command arp - a 84

that an IP address to MAC address entry has been created. 85

So what's the moral of the story? 86

Before traffic can be sent to an IP address on the local segment 87

ARP is required to create a mapping between the layer 3 IP address 88

and the layer 2 MAC address. 89

Wireshark is a sniffing tool that allows you to capture traffic 90

of the local wire to see what�s going on. 91

It's invaluable tool for Network Engineer 92

Let's use Wireshark to see what's taking place in this example 93

So what I'll do firstly is start to capture in Wireshark 94

So on my Ethernet interface, I'll start capturing frames 95

I'll now delete the ARP cache 96

so now no entries are found in the ARP cache 97

I'll ping 10.0.0.254 98

and let's look at the ARP cache again 99

after looking at the ARP cache 100

we can see that an entry has been added for that address 101

and I'll now ping 10.0.0.123 102

so now arp - a shows those 2 entries in the ARP cache 103

Let's stop the capture and let's look for the ARP entries 104

So as you can see here is a broadcast that�s been sent from my local device 105

the protocol used is ARP and I�m asking who has IP address 10.0.0.254 106

tell 10.0.0.3 my local PC 107

So at layer 2 you can see that the destination address is a broadcast 108

the source address is my local machine it�s an ARP request. 109

This is the Ether type for ARP 0x0806 110

and looking at the address resolution protocol for ARP information. 111

Notice we're looking for an IP address 10.0.0.254 112

the sender MAC address is my local machine 113

the target MAC address is unknown 114

and we're looking for IP address 10.0.0.254 115

Once the device has replied back using an ARP reply message 116

I'll be able to ping that device. 117

So in the Wireshark capture you can see I'm sending an echo 118

so you can see the ICMP echo ping request 119

and here are I got the response or reply. 120

Going further down I'll be able to see the ARP request 121

for IP address 10.0.0.123 122

the layer 2 destination is a broadcast, the source is a local MAC address 123

and we're requesting the target MAC address in other words 124

who has IP address 10.0.0.123 125

the reply is a unicast because the device are sent 126

the arp request to knows who the arp request came from. 127

So the destination at layer 2 is my local machine. 128

The source is my local router sender the Mac address 129

sender IP address, target MAC address, target IP address. 130

In this case I�m communicating directly with my local router 131

rather than sending traffic through the router 132

So the MAC address and the IP address used in this example 133

is my local machine and local router. 134

You can see in the output here that the sender MAC address is a Cisco router. 135

IP address is 10.0.0.123 136

target MAC address is my local laptop 137

with the target IP address of 10.0.0.3