Arp Broadcast

Discussion in 'Cisco' started by Martin Leduc, Jan 8, 2008.

  1. Martin Leduc

    Martin Leduc Guest

    Hi,

    I would like to understand.

    If I have a X.0.0.0/8 network mask and a station send a packet to the
    broadcast X.255.255.255, the IP Protocol will send the Packets to all the
    16581375 ip address in the network, even if the switch or the router arp
    table will only contained 100 resolved ip address?

    How can I evaluate the broadcast load over a subnet like the ARP Broadcast,
    DHCP Broadcast or Virus Broadcast (the most important hihihihi).

    Best Regards

    Martin
     
    Martin Leduc, Jan 8, 2008
    #1
    1. Advertising

  2. Martin Leduc

    Trendkill Guest

    On Jan 7, 7:41 pm, "Martin Leduc" <> wrote:
    > Hi,
    >
    > I would like to understand.
    >
    > If I have a X.0.0.0/8 network mask and a station send a packet to the
    > broadcast X.255.255.255, the IP Protocol will send the Packets to all the
    > 16581375 ip address in the network, even if the switch or the router arp
    > table will only contained 100 resolved ip address?
    >
    > How can I evaluate the broadcast load over a subnet like the ARP Broadcast,
    > DHCP Broadcast or Virus Broadcast (the most important hihihihi).
    >
    > Best Regards
    >
    > Martin


    While the arp would go to the address you have said above, a layer 3
    arp would have to match the same network address on the router itself,
    else it will not be propagated. In other words, if that node
    broadcasts to 10.255.255.255, but the router had the network as a
    10.0.0.0 255.255.255.0, then the arp wouldn't go anywhere.

    Presuming the router has a matching subnet mask and address range,
    then yes it will forward to that many addresses (presuming they are
    up), but this is unrealistic unless you have a flat network with that
    many addresses. An arp is only as big as the owning router's local
    subnet, since it will not jump vlans or into other virtual/physical
    interfaces. Also, an arp only goes out physical/virtual interfaces in
    that same network, so unless you had that many switchports, the
    question is also limited beyond your hypothetical situation.
     
    Trendkill, Jan 8, 2008
    #2
    1. Advertising

  3. In article <0Fzgj.4673$>,
    "Martin Leduc" <> wrote:

    > Hi,
    >
    > I would like to understand.
    >
    > If I have a X.0.0.0/8 network mask and a station send a packet to the
    > broadcast X.255.255.255, the IP Protocol will send the Packets to all the
    > 16581375 ip address in the network, even if the switch or the router arp
    > table will only contained 100 resolved ip address?


    Broadcasts are not sent to individual addresses. One packet is sent to
    the LAN's link-level broadcast address; on Ethernet this is
    ff:ff:ff:ff:ff:ff. NICs automatically recognize this address and
    receive the packet as if it were addressed to them.

    > How can I evaluate the broadcast load over a subnet like the ARP Broadcast,
    > DHCP Broadcast or Virus Broadcast (the most important hihihihi).


    Use a sniffer and filter for broadcast packets.

    --
    Barry Margolin,
    Arlington, MA
    *** PLEASE post questions in newsgroups, not directly to me ***
    *** PLEASE don't copy me on replies, I'll read them in the group ***
     
    Barry Margolin, Jan 8, 2008
    #3
  4. Martin Leduc

    Thrill5 Guest

    There are three different types of broadcasts, Layer 2 broadcasts, and two
    types of layer 3 broadcasts and ARP broadcasts are layer 2. Layer 3
    broadcasts are subnet broadcasts, an IP packet sent to 255.255.255.255 (and
    is sent as layer 2 broadcast as well) is ONLY propagated on the local
    subnet. The other type of Layer 3 broadcast is called a "directed
    broadcast" which is sent to a specific subnet. A directed broadcast will be
    sent with a layer 2 address of the default gateway, and it will be routed
    just like any other packet until it gets to the router that has a directly
    connected interface on that subnet. The router that receives a directed
    broadcast will only send it out the directly connected interface if A) the
    directly configured interface is configured to allow directed broadcasts
    with an "ip directed-broadcast" command on that interface and B) the
    interfaces subnet (as calculated by the interfaces IP address and subnet
    mask) is an exact match. If both of these conditions are met, then the
    packet is sent out the interface as a layer 2 broadcast.

    In your example if you have an interface with an IP address of 10.0.0.1/8
    and it receives a directed broadcast to 10.255.255.255, then it will send
    the packet out that interface with a layer 2 destination address of
    ff:ff:ff:ff:ff:ff. Only one packet is sent, not 16 million. Now if the
    router has an interface with an IP address of 10.0.0.1/24 and receives a
    directed broadcast to 10.255.255.255, it would either route the packet to
    the next hop router if a 10.0.0.0/8 (or a default route) routing table entry
    exists or drop the packet because it doesn't have a route.

    To see how much broadcast traffic is being sent on an interface use the
    "show interface" command, which will show you how many unicast and broadcast
    packets have been sent.

    I think you also need to do some research on Layer 2 and Layer 3 addressing.
    In today's IP world, layer 2 addressing and how it works in conjunction with
    Layer 3 protocols such as IP is not well known.


    "Martin Leduc" <> wrote in message
    news:0Fzgj.4673$...
    > Hi,
    >
    > I would like to understand.
    >
    > If I have a X.0.0.0/8 network mask and a station send a packet to the
    > broadcast X.255.255.255, the IP Protocol will send the Packets to all the
    > 16581375 ip address in the network, even if the switch or the router arp
    > table will only contained 100 resolved ip address?
    >
    > How can I evaluate the broadcast load over a subnet like the ARP
    > Broadcast, DHCP Broadcast or Virus Broadcast (the most important
    > hihihihi).
    >
    > Best Regards
    >
    > Martin
    >
    >
    >
     
    Thrill5, Jan 9, 2008
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Ben

    Disable Broadcast???

    Ben, Aug 1, 2004, in forum: Wireless Networking
    Replies:
    5
    Views:
    5,178
    Sooner Al
    Aug 1, 2004
  2. Darren Li

    SSID Broadcast

    Darren Li, Oct 14, 2004, in forum: Wireless Networking
    Replies:
    3
    Views:
    1,059
    Eric Cross [MVP]
    Oct 15, 2004
  3. Alex
    Replies:
    1
    Views:
    1,053
    Jerry Peterson[MSFT]
    Nov 3, 2004
  4. Wirelss Laptop broadcast

    , Apr 16, 2005, in forum: Wireless Networking
    Replies:
    1
    Views:
    457
  5. Darren Green

    Arp or Proxy Arp

    Darren Green, Feb 20, 2009, in forum: Cisco
    Replies:
    0
    Views:
    623
    Darren Green
    Feb 20, 2009
Loading...

Share This Page