Why does a PING reply require an ARP request for the originating hosts MAC?

Question

My list gets the current events from database but shows some months name words multiple time

Question How can I make my out put show the month name only once like in image below

$results = $this->get_events_for_export();

foreach ($results as $result) {

    $date = strtotime($result['event_date']);

    $section->addText(date('M', $date) ."\t". date('d', $date) ."\t". date('D', $date) ."\t". htmlentities($result['event_title']), null, $event_lists);

}

Solution

Original Answer

The first response comes from the hub interface, not host-1 interface. When sending things back you still need to know the mac of the interface with IP of host-1. Some switches do this automatically, others do not.

Improved answer:

              .-----------.
              | hub       |
              |           |
[host-1 i1]+--+hi1     hi2+--+[i2 host-2]
              |           |
              `-----------´

network interfaces: 
i1, i2, hi1, hi2

After sending something to host-1 from host-2 via an IP address in aplication layer, the initial response to host-2 (and all subsequent responses) will come from the hi2 interface, not the i1 interface in host-1.

In order to send anything to the already known IP of host-1, host-2 will still need to know where to send packets on the link layer. To do that, host-2 must request the MAC address of the interface baring the IP of host-1.

Some switches do this kind of translation automatically - they remember the mac-path backwards. Most hubs do not, hence the second request.

Comments

[Thalys]

Just to note that even if you can't upload images directly, imgur would be a lot easier for folk to embed the images than imageshack - for one thing you can just post a direct link to the image

[Sara]

thanks it says i need 10pts to be able to upload image, but for that reason i will try imgur from now on

[Oliver Salzburg]

Correlation doe not imply causation. Obviously, the echo reply is sent before the ARP request, so it's not required for the PING reply. Your operating system may just decide to give the old ARP table a little refresh after having sent the echo reply. Besides that, I would assume that you only rely on information you've determined yourself when implementing a TCP/IP stack. The risk of someone injecting information through specially crafted packets is too high. So you rather resolve MAC-to-IP yourself than use the data you got from previous packets.

[wmz]

This looks as some form of gratuitous ARP. What's target mac in the 5th request? @OliverSalzburg Receiving node must honor information received in ARP packet and insert it into its own table, as specified in RFC 826: tools.ietf.org/html/rfc826

[Sara]

@wmz, well in the 5th request the target mac is unknown (ff:ff:ff:ff:ff:ff) and ip is set for host-1. I have tested it many times but this is how it is, also if i block the last arp req/reply (as i am doing this through an openflow controller), the ping works however arp command yilds valid mac for host-2 inside host-1 machine, while shows it unknown mac for host/1 ip when run at host/2 machine. Because it was my understanding that only single arp req/reply should make both systems aware of each other, so i wanted to know if this is a bug or it really could happen as a normal behavior. Thanks

[Sara]

confusing answer

[Ярослав Рахматуллин]

@Sara okay :\ I hope this is less confusing. The key to understanding this is that there are separate, independent communication layers and they know next to nothing about each other.