Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as

Broadcast ARP 60 Who has 10.162.3.172? Tell 10.162.0.1

Where 10.162.0.1 is the router. I want to determine the source computer from other subnet, which sends this requests. How can I perform it?

UPD subnet is 10.162.0.3.172/24 But if ARP never crosses broadcast domain boundaries then how computers from other networks can know destination of the packets(destination physical address) ? Is it obtained from the arp-table of the router? And why could router send arp requests, except probing addresses in the lease range to see which of them are free?

share|improve this question
    
Your routing table tells your computer to send packages for another subnet to the router. In your subnet, ARP requests are made so that router and computer know who they are, and then the router in turn is going to do ARP requests to find out the MAC of the destination IP. Type route -n on Linux and route something like /print on windows to see it. –  Halfgaar Jun 19 '12 at 7:18
add comment

1 Answer

up vote 4 down vote accepted

The source of the request is the router; it's sending the request, not a device outside the subnet. ARP never crosses broadcast domain boundaries. 10.162.3.172 is in the subnet, as far as the router is concerned, which means the subnet mask on the router is configured as /22 or larger.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.