Same for: 24.1.9 Packet Tracer: Examine the ARP Table
Same for: 7.1.9 Packet Tracer - Examine the ARP Table
9.2.9 Packet Tracer - Examine the ARP Table (Instructor Version)
Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only.
Topology
9.2.9 Packet Tracer - Examine the ARP Table
Addressing Table
Objectives
- Part 1: Examine an ARP Request
- Part 2: Examine a Switch MAC Address Table
- Part 3: Examine the ARP Process in Remote Communications
Background
This activity is optimized for viewing PDUs. The devices are already configured. You will gather PDU information in simulation mode and answer a series of questions about the data you collect.
Part 1: Examine an ARP Request
Step 1: Generate ARP requests by pinging 172.16.31.3 from 172.16.31.2.
a. Click 172.16.31.2 and open the Command Prompt.
b. Enter the arp -d command to clear the ARP table.
C:\> arp -d
c. Enter Simulation mode and enter the command ping 172.16.31.3. Two PDUs will be generated. The ping command cannot complete the ICMP packet without knowing the MAC address of the destination. So the computer sends an ARP broadcast frame to find the MAC address of the destination.
C:\> ping 172.16.31.3
d. Click Capture/Forward once. The ARP PDU moves to Switch1 while the ICMP PDU disappears, waiting for the ARP reply. Open the PDU and record the destination MAC address. Is this address listed in the table above? No. The destination MAC address is the broadcast address FFFF.FFFF.FFFF.
e. Click Capture/Forward to move the PDU to the next device. How many copies of the PDU did Switch1 make? 3
What is the IP address of the device that accepted the PDU? 172.16.31.3
f. Open the PDU and examine Layer 2. What happened to the source and destination MAC addresses? They were swapped. The source MAC address of 172.16.31.2 (000C.85CC.1DA7) became the destination, and the broadcast destination FFFF.FFFF.FFFF was replaced by the MAC address of 172.16.31.3 (0060.7036.2849) as the source.
g. Click Capture/Forward until the PDU returns to 172.16.31.2. How many copies of the PDU did the switch make during the ARP reply? 1
Step 2: Examine the ARP table.
a. Note that the ICMP packet reappears. Open the PDU and examine the MAC addresses. Do the MAC addresses of the source and destination align with their IP addresses? Yes
b. Switch back to Realtime and the ping completes.
c. Click 172.16.31.2 and enter the arp -a command.
C:\> arp -a
Internet Address Physical Address Type
172.16.31.3 0060.7036.2849 dynamicTo what IP address does the MAC address entry correspond? 172.16.31.3
In general, when does an end device issue an ARP request? When it needs to send a frame to an IPv4 address (the destination or the default gateway) whose MAC address is not in its ARP table.
Part 2: Examine a Switch MAC Address Table
Step 1: Generate additional traffic to populate the switch MAC address table.
a. From 172.16.31.2, enter the ping 172.16.31.4 command.
C:\> ping 172.16.31.4
b. Click 10.10.10.2 and open the Command Prompt.
c. Enter the ping 10.10.10.3 command.
C:\> ping 10.10.10.3
How many replies were sent and received? 4 sent, 4 received.
Step 2: Examine the MAC address table on the switches.
a. Click Switch1 and then the CLI tab. Enter the show mac-address-table command.
Switch> show mac-address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0002.1640.8d75 DYNAMIC Fa0/3
1 000c.85cc.1da7 DYNAMIC Fa0/1
1 0060.7036.2849 DYNAMIC Fa0/2
1 00e0.f7b1.8901 DYNAMIC Gig0/1Do the entries correspond to those in the table above? Yes
b. Click Switch0, then the CLI tab. Enter the show mac-address-table command.
Switch0> show mac-address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 0001.6458.2501 DYNAMIC Gig0/1
1 0060.2f84.4ab6 DYNAMIC Fa0/2
1 0060.4706.572b DYNAMIC Fa0/2Do the entries correspond to those in the table above? Yes
Why are two MAC addresses associated with one port? Because both laptops connect to the same switch port (F0/2) through the Access Point.
Part 3: Examine the ARP Process in Remote Communications
Step 1: Generate traffic to produce ARP traffic.
a. Click 172.16.31.2 and open the Command Prompt.
b. Enter the ping 10.10.10.1 command.
C:\> ping 10.10.10.1
Pinging 10.10.10.1 with 32 bytes of data:
Reply from 10.10.10.1: bytes=32 time=1ms TTL=254
Reply from 10.10.10.1: bytes=32 time=12ms TTL=254
Reply from 10.10.10.1: bytes=32 time=1ms TTL=254
Reply from 10.10.10.1: bytes=32 time=6ms TTL=254
Ping statistics for 10.10.10.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 12ms, Average = 5msc. Type arp -a.
C:\> arp -a
Internet Address Physical Address Type
172.16.31.1 00e0.f7b1.8901 dynamicWhat is the IP address of the new ARP table entry? 172.16.31.1
d. Enter arp -d to clear the ARP table and switch to Simulation mode.
C:\> arp -d
e. Repeat the ping to 10.10.10.1.
C:\> ping 10.10.10.1
How many PDUs appear? 2
f. Click Capture/Forward. Click the PDU that is now at Switch1. What is the target IP address of the ARP request? 172.16.31.1
g. The destination IP address is not 10.10.10.1. Why? The gateway address of the router interface is stored in the IPv4 configuration of the hosts. If the receiving host is not on the same network, the source uses the ARP process to determine a MAC address for the router interface serving as the gateway.
Step 2: Examine the ARP table on Router1.
a. Switch to Realtime mode. Click Router1 and then the CLI tab.
b. Enter privileged EXEC mode and then the show mac-address-table command.
Router> enable
Router# show mac-address-table
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----How many MAC addresses are in the table? Why? 0. This command means something completely different on a router than the switch command show mac address-table.
c. Enter the show arp command.
Router# show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 172.16.31.1 - 00E0.F7B1.8901 ARPA GigabitEthernet0/0
Internet 172.16.31.2 1 000C.85CC.1DA7 ARPA GigabitEthernet0/0Is there an entry for 172.16.31.2? Yes
What happens to the first ping in a situation where the router responds to the ARP request? It times out.
