Ethernet Neighbor Discovery?

Question

I am trying to familiarize myself at the moment with the Ethernet network protocol. However, when looking at the standard a Ethernet frame needs a destination MAC address, and the source address MAC is usually programmed onto the device. My questions is how does the a device get that initial destination address. Such as when you plugin a computer into the network first time how does it discover it's neighbors MAC addresses. Like you need to talk with default gateway to get an IP address to send data outside of the network. I have tried looking at the the standards, and I am not sure to exactly search for.

I found this wiki article Link Layer Discovery Protocol, but it looks to be standardized in 2005 and Ethernet is older than that. So what was done before that? It also seems to be a bit more than just give MAC address.

rodolk rodolk · Accepted Answer · 2015-05-29T18:17:18

First, in IP, when a node wants to discover the Ethernet address of a device having certain IP address, it uses Address Resolution Protocol (ARP). It sends an ARP message to the Ethernet broadcast address FF:FF:FF:FF:FF:FF, asking "who has address x.x.x.x?". Every node in the LAN receives the broadcast and passes it up to the ARP implementation. If the receiving node does not have that IP address it just drops the ARP message. If it has it, it responds telling it is the owner of that IP address. Read http://en.wikipedia.org/wiki/Address_Resolution_Protocol if this is what you're looking for. In this way the origin node can learn the hardware address of the destination node (which has the intended IP address) and stores the mapping IP-Ethernet in its ARP cache. The target node and all other nodes learn the mapping for the source node. You can also go to book "Internetworking with TCP/IP", by Comer.

This is an example of an ARP message read with Wireshark:

No.     Time           Source                Destination           Protocol Length Info
     11 0.620140000    CameoCom_e9:0b:a5     Broadcast             ARP      42     Who has 192.168.2.104?  Tell 192.168.2.1

Frame 11: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
    Interface id: 0 (\Device\NPF_{7E4440AD-DCD2-4498-BC69-E8DF0CEB48AB})
    Encapsulation type: Ethernet (1)
    Arrival Time: Dec 20, 2012 01:10:07.389971000 Argentina Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1355976607.389971000 seconds
    [Time delta from previous captured frame: 0.117128000 seconds]
    [Time delta from previous displayed frame: 0.117128000 seconds]
    [Time since reference or first frame: 0.620140000 seconds]
    Frame Number: 11
    Frame Length: 42 bytes (336 bits)
    Capture Length: 42 bytes (336 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:arp]
    [Coloring Rule Name: ARP]
    [Coloring Rule String: arp]
Ethernet II, Src: CameoCom_e9:0b:a5 (00:18:e7:e9:0b:a5), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
        Address: Broadcast (ff:ff:ff:ff:ff:ff)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: CameoCom_e9:0b:a5 (00:18:e7:e9:0b:a5)
        Address: CameoCom_e9:0b:a5 (00:18:e7:e9:0b:a5)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: ARP (0x0806)
Address Resolution Protocol (request)
    Hardware type: Ethernet (1)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (1)
    Sender MAC address: CameoCom_e9:0b:a5 (00:18:e7:e9:0b:a5)
    Sender IP address: 192.168.2.1 (192.168.2.1)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 192.168.2.104 (192.168.2.104)

If you are not using IP, you could still make use of this technique. If you implement your own layer 2 or layer 3 protocol, a node can send a message to Ethernet broadcast to learn the address of a neighbor (you can use ARP or your own implementation).

A node can also sniff the LAN traffic learning the HW address of all neighbors that send a message.

I think with this information you can figure out how to do it depending on your needs.

Ethernet Neighbor Discovery?

1 Answers