I am studying for network and I have a question for ARP echo issue.

I use Wireshark for packet capture, and I OS is windows 7.


ARP Basics ARP stands for Address Resolution Protocol. When you try to ping an IP address on your local network, say, your system has to turn the IP address into a MAC address. This involves using ARP to resolve the address, hence its name.

Systems keep an ARP look-up table where they store information about what IP addresses are associated with what MAC addresses. When trying to send a packet to an IP address, the system will first consult this table to see if it already knows the MAC address. If there is a value cached, ARP is not used.

If the IP address is not found in the ARP table, the system will then send a broadcast packet to the network using the ARP protocol to ask "who has". Because it is a broadcast packet, it is sent to a special MAC address that causes all machines on the network to receive it. Any machine with the requested IP address will reply with an ARP packet that says "I am", and this includes the MAC address which can receive packets for that IP.

I understand ARP is "When trying to send a packet to an IP address, the system will first consult this table to see if it already knows the MAC address. If there is a value cached, ARP is not used."

my topology is [PC-A] - [Switch] - [PC B]

Q. I command to ping [PC B] to [PC A] and I check ARP table is updated.

enter image description here

and a same ping command to [PC B] to [PC A] again.

Already knows the MAC address. but ARP re-echo happend.

enter image description here

looks like that.

I don't have understand for re-echo ARP issue.

  • Do I understand the question correctly? PC A pings PC B. Then, when PC B pings PC A it still sends an ARP request even though B should know about A due to the initial ping. Why is this? – Darren Jan 23 '17 at 9:47
  • almost correct, PC B pings PC A and again PC B pings PC A , already know about PC A and PCB mac address but send an ARP request. why send ARP request? already updated value cached. – Raedoh Jan 23 '17 at 10:28

This is because arp entries are only cached for a certain amount of time. After that, the PC will refresh the entry by re-sending an arp request in case anything has changed (a machine has been given a DHCP lease that was previously used by a different machine, for example). This article explains how long entries are cached for in various versions of Windows. For Vista onwards, they are cached from anywhere between 15 and 45 seconds.

If an entry is not used for a time between 15 to 45 seconds, it changes to the "Stale" state. Then, the host must send an ARP Request for IPV4 to the network when any IP datagram is sent to that destination.

  • 1st picture at 13 line (8.12) and last ICMP ping is 22 line (11.1) 2nd picture last ICMP ping is at 59 line(40.6) and 64line (44.46) you said 15~45sec but second picture is just in 5sec. – Raedoh Jan 23 '17 at 12:44
  • Don't look at the pings, look at the ARP requests that the OP has highlighted. – Darren Jan 23 '17 at 13:17
  • so i understand to don't care about ping at 15~45 seconds time refresh about ARP? am i right? – Raedoh Jan 23 '17 at 13:52
  • The OP was about arp, so yes that's what we're looking at. There is an arp request at 8.1 seconds and then again at 44.5 seconds. So about 36 seconds between the initial request and second one. That is the time it took to refresh the cache. It doesn't matter that communications between the two machines (ICMP ping or otherwise) have been continuous between these events, the PC still makes sure it's arp cache is valid. – Darren Jan 23 '17 at 13:58
  • oh i exactly understand it! thank you very much Darren. I luv U Have a nice day! – Raedoh Jan 23 '17 at 14:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.