DEV Community

Tejas Shinkar
Tejas Shinkar

Posted on

How Hosts Actually Communicate on a Network- ARP and Default Gateway

#networking #aws #cloud #devops

šŸŒ ARP and Default Gateway

Everything Hosts Do to Speak on the Internet ā€” Part 1 & Part 2

Series: Networking Fundamentals for Cloud & DevOps ā€” Part 3 of 6

We already know that IP addresses are used at Layer 3 and MAC addresses are used at Layer 2. But there is an important practical question: what does a host do when it knows the destination IP but doesn't know the destination MAC?

The answer is ARP.

Part 1 ā€” When the Destination Is on the Same Network

Suppose we have two hosts:

Host A
MAC:  a2a2
IP:   10.1.1.22
Mask: 255.255.255.0

Host B
MAC:  b3b3
IP:   10.1.1.33
Mask: 255.255.255.0
Enter fullscreen mode Exit fullscreen mode

With a /24 mask:

255.255.255.0

Network = 10.1.1.0/24
Enter fullscreen mode Exit fullscreen mode

Both hosts belong to the same network:

10.1.1.0/24
Enter fullscreen mode Exit fullscreen mode

Therefore, they can communicate directly at Layer 2.

1. A Wants to Send Data to B

Suppose A wants to send:

Data ā†’ B
Enter fullscreen mode Exit fullscreen mode

A already knows B's IP address:

B's IP = 10.1.1.33
Enter fullscreen mode Exit fullscreen mode

Maybe A learned this IP from DNS, or the application already knows it.

So A can create the Layer 3 IP header:

L3:

SRC IP = 10.1.1.22
DST IP = 10.1.1.33
Enter fullscreen mode Exit fullscreen mode

But there is a problem.

A doesn't know:

B's MAC = ?
Enter fullscreen mode Exit fullscreen mode

And Ethernet / Layer 2 needs a destination MAC address.

So:

IP address is known, but MAC address is unknown ā†’ use ARP.

2. ARP = Address Resolution Protocol

ARP = Address Resolution Protocol.

ARP basically asks:

"Who has IP 10.1.1.33? Tell me your MAC address."

A sends an ARP Request.

Conceptually:

Host A

My IP  = 10.1.1.22
My MAC = a2a2

Who has 10.1.1.33?
Please tell me your MAC.
Enter fullscreen mode Exit fullscreen mode

The important point is that A knows the destination's IP, but needs to discover the corresponding MAC.

3. Why Is the ARP Request Broadcast?

A doesn't know B's MAC yet.

So A cannot send the ARP request directly to B's unicast MAC address.

Instead, it uses the special Ethernet broadcast MAC:

ff:ff:ff:ff:ff:ff
Enter fullscreen mode Exit fullscreen mode

Meaning:

Send this to everyone on the local network.

Conceptually:

                 ARP Request
A ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā†’ Everyone
                              ā”‚
                              ā”œā”€ā”€ B
                              ā”œā”€ā”€ C
                              ā”œā”€ā”€ D
                              ā””ā”€ā”€ ...
Enter fullscreen mode Exit fullscreen mode

Every device on the local network receives the ARP request.

But only the device whose IP address matches:

10.1.1.33
Enter fullscreen mode Exit fullscreen mode

cares about it.

4. Host B Responds

B sees:

"Who has 10.1.1.33?"

B knows:

My IP  = 10.1.1.33
My MAC = b3b3
Enter fullscreen mode Exit fullscreen mode

So B sends an ARP Reply directly back to A:

10.1.1.33 ā†’ b3b3
Enter fullscreen mode Exit fullscreen mode

Conceptually:

"I am 10.1.1.33, and my MAC address is b3b3."

This response is unicast, because B now knows A's MAC address.

5. ARP Cache

A stores the discovered mapping:

ARP Cache

10.1.1.33 ā†’ b3b3
Enter fullscreen mode Exit fullscreen mode

Similarly, B can learn:

10.1.1.22 ā†’ a2a2
Enter fullscreen mode Exit fullscreen mode

Now, if A wants to communicate with B again, it doesn't need to immediately broadcast another ARP request.

It can simply check its ARP cache:

10.1.1.33
     ā†“
   b3b3
Enter fullscreen mode Exit fullscreen mode

Then A can construct the Ethernet frame.

ARP gives the host the Layer 2 address it needs after knowing the Layer 3 destination.

6. A Can Finally Send the Actual Data

A now knows both:

Destination IP  = 10.1.1.33
Destination MAC = b3b3
Enter fullscreen mode Exit fullscreen mode

So it creates:

Layer 3 header 

SRC IP = 10.1.1.22
DST IP = 10.1.1.33
Enter fullscreen mode Exit fullscreen mode

Layer 2 header 

SRC MAC = a2a2
DST MAC = b3b3
Enter fullscreen mode Exit fullscreen mode

The resulting structure is:

ā”Œā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”
ā”‚ L2 Header                    ā”‚
ā”‚ SRC MAC: a2a2                ā”‚
ā”‚ DST MAC: b3b3                ā”‚
ā”œā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”¤
ā”‚ L3 Header                    ā”‚
ā”‚ SRC IP: 10.1.1.22            ā”‚
ā”‚ DST IP: 10.1.1.33            ā”‚
ā”œā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”¤
ā”‚ Data                         ā”‚
ā””ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”˜
Enter fullscreen mode Exit fullscreen mode

And it is sent:

A ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā†’ B
Enter fullscreen mode Exit fullscreen mode

7. What Happens When B Receives It?

B receives the Ethernet frame.

First, B checks the destination MAC:

DST MAC = b3b3
Enter fullscreen mode Exit fullscreen mode

That's B's own MAC, so B accepts the frame.

Layer 2 processing

The Layer 2 header is removed.

L2 āœ“
Enter fullscreen mode Exit fullscreen mode

B then processes the Layer 3 information:

Destination IP = 10.1.1.33
Enter fullscreen mode Exit fullscreen mode

That's B's own IP address.

So the IP header is processed and removed:

L3 āœ“
Enter fullscreen mode Exit fullscreen mode

The remaining data moves upward to the appropriate protocol/application:

L2 ā†’ remove
L3 ā†’ process/remove
L4 ā†’ process
L7 ā†’ application
Enter fullscreen mode Exit fullscreen mode

The Most Important Distinction

This is one of the most important things to remember:

IP Address

Answers:

Which host ultimately should receive this data?

MAC Address

Answers:

Which device should receive this frame on this local network/hop?

That's why:

L3 ā†’ IP  ā†’ End-to-end destination

L2 ā†’ MAC ā†’ Current hop
Enter fullscreen mode Exit fullscreen mode

ARP connects these two worlds by resolving:

IP address ā†’ MAC address
Enter fullscreen mode Exit fullscreen mode

Part 2 ā€” What Happens When the Destination Is on Another Network?

Now consider a more realistic situation.

Host A wants to communicate with Host C, but C is on a different network.

Host A                         Router                         Host C
10.1.1.22                      10.1.1.1                       10.9.9.44
MAC a2a2                       MAC e5e5                       MAC c4c4
     ā”‚                              ā”‚                              ā”‚
     ā””ā”€ā”€ā”€ā”€ā”€ā”€ Local network ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”˜ā”€ā”€ā”€ā”€ā”€ā”€ Other networks ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”˜
Enter fullscreen mode Exit fullscreen mode

A wants to send data to:

Destination IP = 10.9.9.44
Enter fullscreen mode Exit fullscreen mode

A checks its subnet:

10.1.1.0/24
Enter fullscreen mode Exit fullscreen mode

and realizes:

10.9.9.44 is NOT in my network.
Enter fullscreen mode Exit fullscreen mode

So A needs the default gateway / router.

This is the key difference from Part 1:

A does NOT ARP for C. A ARPs for its default gateway.

1. A Knows C's IP

The Layer 3 destination remains C:

SRC IP = 10.1.1.22
DST IP = 10.9.9.44
Enter fullscreen mode Exit fullscreen mode

Notice that the destination IP is still the final destination.

A does not replace C's IP with the router's IP.

2. A ARPs for the Gateway

A asks:

"Who has 10.1.1.1? Tell me your MAC."

The router replies:

10.1.1.1 ā†’ e5e5
Enter fullscreen mode Exit fullscreen mode

A stores this in its ARP cache:

ARP Cache

10.1.1.1 ā†’ e5e5
Enter fullscreen mode Exit fullscreen mode

Now A knows the MAC address of the device that should receive the frame.

3. A Creates the Frame

Now notice the important part.

Layer 3: 

SRC IP = 10.1.1.22
DST IP = 10.9.9.44
Enter fullscreen mode Exit fullscreen mode

Layer 2: 

SRC MAC = a2a2
DST MAC = e5e5
Enter fullscreen mode Exit fullscreen mode

So:

IP says:

"Ultimately go to C"
             ā†“
A ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā”€ā†’ Router


MAC says:

"This particular frame goes to the router"
Enter fullscreen mode Exit fullscreen mode

This is one of the most important concepts in these networking fundamentals.

The IP packet is intended for the final destination, but the Ethernet frame is intended for the next hop.

4. Router Receives the Frame

The router receives the Ethernet frame.

It sees:

DST MAC = e5e5
Enter fullscreen mode Exit fullscreen mode

That's its own MAC address, so it accepts the frame.

The router removes/processes the Layer 2 header.

Now it looks at the Layer 3 destination:

DST IP = 10.9.9.44
Enter fullscreen mode Exit fullscreen mode

The router checks its routing table to determine where the packet should go next.

This connects directly to what we learned earlier:

Routers make forwarding decisions using Layer 3 destination IP addresses and routing tables.

5. Router Forwards It Hop-by-Hop

There may be multiple routers between A and C:

A
ā”‚
ā–¼
Router 1
ā”‚
ā–¼
Router 2
ā”‚
ā–¼
Router 3
ā”‚
ā–¼
C
Enter fullscreen mode Exit fullscreen mode

At every hop, the Layer 2 / MAC addresses change.

But the Layer 3 destination remains:

10.9.9.44
Enter fullscreen mode Exit fullscreen mode

For example:

Hop 1 

MAC: A ā†’ Router 1
IP:  A ā†’ C
Enter fullscreen mode Exit fullscreen mode

Hop 2 

MAC: Router 1 ā†’ Router 2
IP:  A ā†’ C
Enter fullscreen mode Exit fullscreen mode

Hop 3 

MAC: Router 2 ā†’ Router 3
IP:  A ā†’ C
Enter fullscreen mode Exit fullscreen mode

So the mental model is:

MAC = current hop
IP  = final destination
Enter fullscreen mode Exit fullscreen mode

This is exactly why we previously described:

L2 ā†’ Hop-to-hop
L3 ā†’ End-to-end
Enter fullscreen mode Exit fullscreen mode

ARP in One Picture

The complete idea can now be summarized as:

Same network:

A ā”€ā”€ ARP for B's MAC ā”€ā”€ā†’ B
        ā”‚
        ā””ā”€ā”€ IP known
            MAC unknown


Different network:

A ā”€ā”€ ARP for gateway's MAC ā”€ā”€ā†’ Router
                                 ā”‚
                                 ā–¼
                              Other network
                                 ā”‚
                                 ā–¼
                                  C
Enter fullscreen mode Exit fullscreen mode

The crucial difference:

Same network
ā†’ ARP for destination host

Different network
ā†’ ARP for default gateway
Enter fullscreen mode Exit fullscreen mode

The Complete Mental Model

When a host wants to send an IP packet:

1. Know the destination IP
          ā†“
2. Check: Is destination in my local network?
          ā†“
      ā”Œā”€ā”€ā”€ā”“ā”€ā”€ā”€ā”€ā”
     YES       NO
      ā”‚         ā”‚
      ā†“         ā†“
ARP for       ARP for
destination   default gateway
MAC           MAC
      ā”‚         ā”‚
      ā””ā”€ā”€ā”€ā”€ā”¬ā”€ā”€ā”€ā”€ā”˜
           ā†“
   Build Ethernet frame
           ā†“
      Send to next hop
Enter fullscreen mode Exit fullscreen mode

And remember the hierarchy:

L4 ā†’ Port  ā†’ Which service?
L3 ā†’ IP    ā†’ Which host/network ultimately?
L2 ā†’ MAC   ā†’ Which device on this hop?
L1 ā†’ Bits  ā†’ Physical transmission
Enter fullscreen mode Exit fullscreen mode

For your Cloud + DevOps learning, this becomes extremely important when reasoning about:

  • VPC routing
  • Subnets
  • Default routes
  • VPC routers
  • Security Groups
  • NACLs
  • Load Balancers
  • Connectivity troubleshooting

The AWS abstraction changes, but the underlying question remains the same:

Where is the destination, and what is the next hop needed to reach it?

Part 3 of 6 ā€” Networking Fundamentals for Cloud & DevOps

A prerequisite for understanding AWS VPC routing, subnets, gateways, and connectivity troubleshooting.

Top comments (0)