Cisco ICND1 Flashcard: MAC Addresses and ARP

Taking CCNA Bootcamp course prepares you well for CCNA exam success. They've also created two new exams, the ICND1 and ICND2 which is equivalent to the CCNA split over two component exams. Of course that ends up costing twice as much but you'll half the material to study for. Anyway, you'll have know the fine details of basic information such as MAC addresses and ARP.


Which command will you use on a Cisco router to display the arp cache?
a) arp -a (PC Windows, displays arp cache)
b) arp -s
c) show ip arp (that's right!)

d) arp -d (PC Windows, clears arp cache)

The answer may seem tricky because you've probably seen all of these commands used somewhere in Windows or Linux, but only one is for Cisco. You'll have to pick the right one. Read on!

A MAC address has 12 hex digits, each digit is 4 bits, therefore it is also called a 48 bit addressing. The digits are usually listed in pairs or quads.
For example: 00204a32b0b2

1 bit broadcast
1 bit local
22 OUI
24 vendor assigned (6 bits hex)

A MAC address is also called the Ethernet address, found on the NIC card, known within the LAN.

The Ethernet Frame (Layer 2) has a header and trailer; the trailer containing the FCS for error detection. Error packets are just dropped so lost data will be noticed.
However it's at the TCP/IP (Layer 4) where the error recovery will take place, not here in Layer 2.

The Layer 2 Data Link Layer has two sub components:
802.2 is the Logical Link Control, LLC
802.3 is the Media Access Control, like the MAC address
The 802.2 applies to the Ethernet and Token Ring.

The IEE splits the OSI Data Link Layer into two components or interfaces.
LLC - transitions up to the Network Layer
MAC - transitions down to the Physical Layer (assigning a burned in address to a physical device)


A Switch is a Layer 2 device. Switches examine headers, ports, and does buffering (depends on the format of switching).
A switch provides dynamic addressing by learning the source MAC address of each frame received and the associated port number. Commands for clearing away a switch's MAC address table:

show mac-address table d
clear mac-adress-table

ARP (Address Resolution Protocol) is the command to map and IP address to a physical address on the network.  ARP is used to connect the OSI Layer 3 (Network) to OSI Layer 2 (Data-Link).  ARP entries are usually dynamically created by the ARP protocol, for example to find a route to an webpage on the Internet, say http://www.thebarbiegeek.blogspot.com/ but first the laptop computer has to resolve the hostname with  DNS server, and let's say it comes to 10.1.1.1 but before the laptop computer can communicate with the IP address, it must know the corresponding MAC address.

• Host A checks its local ARP cache to verify if it is a previously learned address. The ARP cache is typically purged after 5 minutes (300 seconds)
• If the IP address is not found, host A sends out a broadcast that all systems on the physical segment will receive and process
• Host B recognizes its IP address and will respond with a MAC address to host A
• Host A now has host B's MAC address, and will proceed to send the data
• Host A will add to the ARP table, host B's IP address and the matching MAC address

Cisco Command (does this show MAC address of devices in the subnet?)

show ip arp
show cdp neighbors (another handy command that shows the IP address, MAC address and other info of directly connected devices)
clear arp (to flush the arp cache)

The fields in the ARP table:
Protocol - the protocol for the network address in the Address field, say Internet
Address - the network address that corresponds to the hardware address
Age - the age in minutes of the cache entry, or dash (-) means local
Type- the encapsulation type, ARPA, SNAP, SAP
Interface - the interface associated with this network address, say fa 0/0

Windows Command
arp -a
will display the ARP cache table

arp -a -N 10.1.1.1
will display the MAC address assigned the IP address

arp -s 10.1.1.1 00-AA-00-4F-2A-9C
to add a static ARP cache entry for IP address 10.1.1.1 to the physical address 00-AA-00-4F-2A-9C

arp -d the.ip.address.here to delete the mac address it associates, say you are attaching a different networked device with the same IP address.

Linux
ifconfig (displays the network information of the host, self)
arp -a to list the mac addresses
arp -d to delete the mac address associates, say you are attaching a different networked device with the same IP address.

I have used this command many times to assign a new IP address to a specific hardware, found in /sbin/arp -s $unit_ip $unit_mac
Start with the ping or ifconfig command if you have to reference the MAC address.
Where $unit_ip is the IP address and $unit_mac is the MAC address in lowercase without delimiters.
That links the IP address to the MAC address
telnet $unit_ip 1 (might fail)
telnet $unit_ip 9999 (telnet to a port assigned to connect to the hardware)
"Press Enter to go into Setup Mode", and you will enter the IP address octets and the gateway address at the prompts.