Вы находитесь на странице: 1из 6

ARP for HSRP Mac address

Krishna 771 posts since Aug 24, 2011


ARP for HSRP Mac address May 21, 2013 8:58 PM
Hi Guys,

Please the network diag below:

R2 and R3 is running HSRP in their fa1/0 port and the stand by ip is 24.1.1.100

My questions is regarding the ARP packet capture by Wireshark for this IP.

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
1
ARP for HSRP Mac address

From the screenshot above, it is clear that for the IP 24.1.1.11 the router is sending the ARP to the destination
MAC ffff:ffff:ffff

But when it ARPs for the standbt virtual IP it sends it to 0000:0c07:ac01. ARP should always go to
ffff:ffff:ffff..right?

How the router know thats its a standby IP and it sends the ARP to 0000:0c07:ac01. ?

Krishna

eawnorowski 246 posts since May 14, 2011


Re: ARP for HSRP Mac address May 21, 2013 10:03 PM
You see two flows because one is for the IP of the routers (Bcast) and the other for HSRP ( Mcast address in
the form of 0000.0c07.ac<Hex_for_standby_group_#>).

HTH,
Ed.

Krishna 771 posts since Aug 24, 2011


Re: ARP for HSRP Mac address May 21, 2013 10:30 PM
in response to eawnorowski
Ed,

I didn't get you.

Krishna

Chandan Singh Takuli 3,900 posts since Feb 16, 2012


Re: ARP for HSRP Mac address May 21, 2013 10:55 PM
in response to Krishna
Hi Krishna

The broadcast is for clients & switch to inform them about the current active gateway.

While 0000:0c07:ac01 is a multicast address for HSRP. on which all HSRP routers listen & communciate with
each other.

Krishna 771 posts since Aug 24, 2011


Re: ARP for HSRP Mac address May 21, 2013 11:23 PM

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
2
ARP for HSRP Mac address

in response to Chandan Singh Takuli


Hi Chandan,

I got your point.

My question is how does the client know whether to send the ARP to FFFF:FFFF:FFFF or to 0000:0c07:ac01?

Krishna

eawnorowski 246 posts since May 14, 2011


Re: ARP for HSRP Mac address May 21, 2013 11:43 PM
in response to Krishna
Requests sent to 0000:0c07:ac01 are inherent to HSRP operation, regular ARPs are sent to ffff.ffff.ffff.

HTH
Ed.

Krishna 771 posts since Aug 24, 2011


Re: ARP for HSRP Mac address May 22, 2013 12:23 AM
in response to eawnorowski
Ed,

I'm aware of it. :-)

My question is how does the client know whether to send the ARP to FFFF:FFFF:FFFF or to 0000:0c07:ac01
since the client is unaware of the HSRP operation.

Krishna

eawnorowski 246 posts since May 14, 2011


Re: ARP for HSRP Mac address May 22, 2013 12:32 AM
in response to Krishna
I'm not sure exactly what you're looking for, IOS determines which IP/MAC address is used in each case
depending on the configuration of the device.
What do you mean when you say "the client" ?

Ed.

Chandan Singh Takuli 3,900 posts since Feb 16, 2012

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
3
ARP for HSRP Mac address

Re: ARP for HSRP Mac address May 22, 2013 12:54 AM
in response to Krishna
Hi Krishna

i think you colllected that packet from a wireshark on a pc port? am i right?

so its listed/captured all communication coming on its interface. broadcast & multicast.

kamalakumar.k 76 posts since Aug 18, 2008


Re: ARP for HSRP Mac address May 22, 2013 1:30 AM
in response to Krishna
Hi,

Your router ie the gateway of you network will respond with the hsrp mac instead of physical mac .. then ur
client will send all its traffic to the hsrp mac...

Client need to reach destination x which is conencted to other end of ur gateway.... So ur client will send its
data to f.f.f.f broadcast since it doesn't know the mac of the destination x. This will be picked by ur gateway as
it s running hsrp it ll respond to the client using the standby ip and the vritual Hsrp mac ... Now ur client will use
this Mac to send data for the destination x...

Rgd,
Kamal

Dmcneil 1,163 posts since Apr 26, 2010


Re: ARP for HSRP Mac address May 22, 2013 7:39 AM
As I understand it Control information for HSRP is actually sent to the all routers Multicast address
224.0.0.2(v1) or 224.0.0.102(v2). Im not current on converting multicast IP addresses to MAC addresses,
but according to the OCG and FLG for SWITCH the mac address in the form of : 0000.0c07.acxx(v1) or
0000.0c9f.fxxx(v2) is the address sent to clients. The Virtual MAC and IP address is given to the clients and the
current active HSRP Router responds to them.

HSRP ensures neighboring routers are active by hello messages sent to the 224.0.0.2 (HSRPv1) or
224.0.0.102 (HSRPv2). If they aren't received then the standby assumes the active has failed and will pick up
servicing the Virtual MAC/IP.

My question is how does the client know whether to send the ARP to FFFF:FFFF:FFFF or
to 0000:0c07:ac01?

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
4
ARP for HSRP Mac address

The client will never send an ARP request to 0000.0c07.ac01 it will only use that address when sending
packets directly to its default gateway. When the client recognizes it needs to forward a packet to its default
gateway for further delivery it will check its MAC address table for the MAC address corresponding to the IP
address if its default gateway. In your scenario, I assume the default gateway address is 24.1.1.100 and its
MAC address would be 0000.0c07.ac01 (HSRP standby group 1).

Client would check its MAC address table and if it isn't there it will send an ARP to ffff.ffff.ffff. to find
24.1.1.100's MAC address. So the answer to your question is the client will never need to send an ARP to
0000.0c07.ac01 because that is not how the ARP process works. It will only send an arp to the broadcast mac
so that every station will receive it.

Now, as far as the line pertaining to the echoing of the ARP packet to all the routers in the HSRP group. I'm
unsure if there is a mechanism in HSRP that helps send along ARPs to the active router. I would have to
conduct more research. But that's what seems like is happening in your wireshark capture. For some reason
the router is echoing the ARP to all of the routers participating in HSRP.

Try turning off name resolution for MAC addresses and IP address and redoing the wire capture. I'd like to see
the actually address represented by "broadcast" and "All-HSRP-routers_01"

(on a side note, 224.0.0.2 is the all router's multicast address. Isn't it incorrect to call it the HSRP multicast
group as wireshark has labeled?)

Krishna 771 posts since Aug 24, 2011


Re: ARP for HSRP Mac address May 23, 2013 10:38 PM
in response to Dmcneil
Hi dmcneil,

"Now, as far as the line pertaining to the echoing of the ARP packet to all the routers in the HSRP group. I'm
unsure if there is a mechanism in HSRP that helps send along ARPs to the active router."

This is the same point where Im also doubtful.

Krishna

Chandan Singh Takuli 3,900 posts since Feb 16, 2012


Re: ARP for HSRP Mac address May 23, 2013 11:09 PM
in response to Krishna
Hi Krishna

you are using router as a host that is why its displaying you the multicast sent to that.

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
5
ARP for HSRP Mac address

it is teh behaviour of gns3 only. it will not happen in real scenario with cisco gears.

2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
6