ARP Request question. 1

[xXMichealXx]

Hi ALL,

I have a simple question, to which I have been unable to source an accurate answer. (Including reading rfc826)

All hosts on a subnet recieve ARP requests. Will a host respond to a ARP request if it has a MAC address for the requested IP address in its ARP cache? Even if the IP address does not belong to the host.

This question is directed at Host machines, not routers.

I have found several conflicting answers, and have been unable to reproduce in a controlled manner.

 

[bcastner]

ARP requests, (and everything else on an ethernet segment) is sent to everyone in that segment. The IP address in the destination should be the only responder (if it is on the local subnet).

The exception is any device acting as a gateway. In that case a discovery request is made to the highest IP in the segment with a MAC of 'ffffffffff'. The Gateway device will return if possible the MAC address being sought.

No non-gateway device should respond to an ARP request in which its IP is not in the destination address.

 

[xXMichealXx]

Thanks.

That reconfirms what I already believed.

I was only asking as I have read some interesting articles relating to ARP broadcast storms as a result of the current W32.Blaster.Worm virus being attributed to other hosts responding to infect machine ARP requests.

 

[bcastner]

Blaster once it finds an open port on 135 at a random IP and does it stuff, begins sequentially from that first IP. This is why you will see local storms, but they are unlikely ARP storms more like a barrage of port 135 TCP open requests, and UDP storms on port 4444.

 

[jpm121]

Sobig.F is associated with a boatload of APR traffic, based on posts I've seen.