3.1.a [ii] ARP
from doyle, vol 1 routing tcpip
A device needing to discover the data-link identifier of another device will create an ARP Request packet. This request will contain the IPv4 address of the device in question (the target) and the source IPv4 address and data-link identifier (MAC address) of the device making the request (the
sender). The ARP Request packet is then encapsulated in a frame with the sender’s MAC
address as the source and a broadcast address for the destination.
3.1.a [ii] ARP
The Address Resolution Protocol (ARP) was developed to enable communications on an internetwork. Layer 3 devices need ARP to map IP network addresses to MAC hardware addresses so that IP packets can be sent across networks. Before a device sends a datagram to another device, it looks in its ARP cache to see if there is a MAC address and corresponding IP address for the destination device . If there is no entry, the source device sends a broadcast message to every device on the network. Each device compares the IP address to its own . Only the device with the matching IP address replies to the sending device with a packet containing the MAC address for the device (except in the case of “proxy ARP” where a router can reply to ARP request on behalf of another host). The source device adds the destination device MAC address to its ARP table for future reference, creates a data-link header and trailer that encapsulates the packet, and proceeds to transfer the data.
High CPU utilization in the ARP input process occurs if the router has to originate an excessive number of ARP requests. The router uses ARP for all hosts, not just those on the local subnet, and ARP requests are sent out as broadcasts , which causes more CPU utilization on every host in the network. ARP requests for the same IP address are rate-limited to one request every two seconds, so an excessive number of ARP requests would have to originate for different IP addresses. This can happen if an IP route has been configured pointing to a broadcast interface (as opposed to next-hop). A most common example is a default route such as:
ip route 0.0.0.0 0.0.0.0 Fastethernet0/ 0
In this case, the router generates an ARP request for each IP address that is not reachable through more specific routes, which practically means that the router generates an ARP request for almost every address on the Internet.
Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 2252-2253). . Kindle Edition.
3.1.a [i] Address types, VLSM
There are three types of IPv4 addresses, namely:
● Host address ● Network or Subnetwork address ● Broadcast address
Within each type, there are five classes that addresses can be carved out from. Those classes are known as A, B, C, D, and E.
Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 2229-2235). . Kindle Edition.
3.1.a [i] Address types, VLSM
the minus 256 technique
this presupposes knowledge of binary and ip addressing conventions
rule 1. remember that the first octet only ever designates the class
of ip, ie. a b or c
rule 2. the first octet that contains a zero bit, is always the octet
where the action occurs, ie, 255.255.255.0, calculation happens in 4th
octet; or 255.255.0.0, calculation happens in third octet; or
255.255.248.0, calculation occurs in 3rd octet, and so on.
rule 3. see rule number 1. The first octet always tells you the class
of address no matter the octet where subnetting occurs. Subnetting
calculation always happens in the octet of the ip address that the
subnet mask designates with its first instance of less than 255, or
more simply, the first instance of a zero bit.
therefore, given 172.16.10.10 mask of 255.255.248.0, we know that the
calculation will happen in the ip’s 3rd octet. The mask designates
that with 248. it is imperative that this is understood.
another way of looking at it in the above example is; the octet in the
subnet mask with the first instance of less than 255, or the first
zero bit, is the multiplier.
rule 4. when the multiplier (first zero bit octet or octet with first
instance of less than 255) is determined always subtract it from 256
to determine the ranges.
ie. 256-248=8, hence 8 is the multiplier.
using 172.16.10.10 with 255.255.248.0, it is determined that we have a
class b address 172, our calculation must happen in the 3rd octet, and
we must subtract 256 from 248 to get 8.
the rest is academic:
the multiplier ( has determined our first subnet range
8 16 24 32 40, etc
the first range (excepting the use of subnet zero) begins with 8 and
ends with 15, the second range begins with 16 and ends with 31, next
range begins with 32, and so on up to 255.
Important: there are 256 numbers total comprising the range 0-255,
including the zero.
in the ip 172.16.10.10 /21 (notice the use of bit count; this equals
248 as well. to determine the number to subtract from 256 in bit
count form, you need to add the bits…
1st octet 8 bits, second octet 8 bits, third octet 5 bits, hence 8 + 8
+ 5 =/21 or 248 or
172.16.10.10 /21 = 172.16.10.10 255.255.248.0
our calculation takes place in the octet designated by the first
instance of a zero, or in our example, /21 or 255.255.248.0. we
determine that 10 is the number occupying the third octet in our
example, and our multiplier has determined the first possible subnet
is 8 (excepting subnet zero)
so, since 10 falls between 8 and 15 (16 begins the next subnet or
network), our valid range for the address has been determined.
8 16 32…
so our octet 3 number, which is 10 in the example, can only fall
between the range of 8 (the network), 9 our first valid host, 14 our
last valid host, and 15 which is the broadcast address for the network
our number ten resides in.
if we changed our third octet number to 172.16.20.10 /21 or
255.255.248.0, we know that our calculation still takes place in the
3rd octet, but the number 20 falls between the network 16, the
broadcast 31, and within the valid range of hosts which is 17-30…
one more example:
the class of address is C
the action takes place in octet 4
subtract 192 from 256 which equals 64 and we can determine the
network, the broadcast and the valid range of hosts because 64 is our
64 128 192
65 129 193
126 190 254
127 191 255
our number in octet 4 is 100, our number 100 falls between 64 (the
first network) and 128 (the second network). the subnet address is
the first valid host is 192.168.100.65
the last valid host in the range is 192.168.100.126
and the broadcast address is 192.168.100.127