several computers share one public address(one router) and each one has
an unique private ip address, the MAC address of others can't be
obtaned by using ARP command, but that which is in the same workgroup
with you can be obtained by using arp -a after a PING. am i right?

In article <1148293490.257691.113970@j73g2000cwa.googlegroups .com>,
"index" <mailtumengyu@gmail.com> wrote:

> several computers share one public address(one router) and each one has
> an unique private ip address, the MAC address of others can't be
> obtaned by using ARP command, but that which is in the same workgroup
> with you can be obtained by using arp -a after a PING. am i right?

Yes. The ARP command simply displays the ARP cache. If you haven't
tried to communicate recently with an IP, it won't be in the cache yet,
so the ARP command won't display it.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

In article <1148293490.257691.113970@j73g2000cwa.googlegroups .com>,
index <mailtumengyu@gmail.com> wrote:
>several computers share one public address(one router) and each one has
>an unique private ip address, the MAC address of others can't be
>obtaned by using ARP command, but that which is in the same workgroup
>with you can be obtained by using arp -a after a PING. am i right?

Only if you are also on the same side of the router. If you are
outside of the router that is doing the address translation,
then it does not matter whether you are in the same workgroup or
not: what you will see (if anything) from arp -a after a ping is
just going to be the MAC of the next hop towards the host
(i.e., your router if you are multiple hops away, or the
MAC of the router that is doing the NAT if you are on the same segment
as the router's outside interface.)

If you are on the same side of the router as the hosts you are trying
to reach, so that you are not going through address translation
to reach them, then again it does not matter whether you are in the
same workgroup or not: arp -a will show you the MAC's of whichever
of the hosts your system has recently communicated with.

of course we are on the same side of the router.

a question happens to me! i'm on the same side of the router as the
host i'm trying to reach, after i send a ping message, this message
first reach the router, although the router doesn't do network address
translation,i knew that, the router is still a hardware, so the router
will replace source MAC address of this ping message with its own MAC
address and vice versa when the destination send back the reply
message. then i wonder why i can get its MAC address by using arp -a
after that?
any ideas?

maybe only when NAT or routing function is executed will the source MAC
address be changed. hope it's right!

In article <1148375464.935454.44770@j55g2000cwa.googlegroups. com>, "index" <mailtumengyu@gmail.com> writes:
> a question happens to me! i'm on the same side of the router as the
> host i'm trying to reach, after i send a ping message, this message
> first reach the router,

Your PING won't go through the router. It'll go straight to the
target workstation. And the reply will come straight back as well.

In the usual case, your routing table will look something like:

Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.127 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.127 192.168.1.127 1
192.168.1.127 255.255.255.255 127.0.0.1 127.0.0.1 1
192.168.1.255 255.255.255.255 192.168.1.127 192.168.1.127 1
224.0.0.0 224.0.0.0 192.168.1.127 192.168.1.127 1
255.255.255.255 255.255.255.255 192.168.1.127 192.168.1.127 1
Default Gateway: 192.168.1.1

If you are sending that PING to a piece of equipment on the same side
of the router you are on then that piece of equipment will normally
be in the same IP subnet you are in.

Let's say that you are at 192.168.1.127 and your target is at 192.168.1.200

If you consult the above routing table, you'll find that there are two
possible routes to reach a destination address of 192.168.1.200.

The first candidate route is 0.0.0.0 with a netmask of 0.0.0.0. This
is your default route. It always matches.

The second candidate route is 192.168.1.0 with a netmask of 255.255.255.0
This is your connected interface route onto the 192.168.1 subnet.

[Take the bitwise AND of your indended destination address and the
netmask from the routing table entry. If the result matches the
destination from that routing table entry then the route is a valid
candidate for your destination.

192.168.1.200 AND 0.0.0.0 = 0.0.0.0 which matches 0.0.0.0
192.168.1.200 AND 255.255.255.0 = 192.168.1.0 which matches 192.168.1.0]

By rule, the matching routing table entry with the narrowest netmask
(most 1 bits) wins.

In this case the default route loses.
In this case the connected interface route wins.

On Ethernet, this means that your workstation will consult its ARP
cache and send an ARP request if neccessary, asking for the MAC
address of 192.168.1.200. Once the ARP reply is received, it
will send the PING request in an Ethernet unicast frame addressed
to the MAC address that ARP has told it belongs to 192.168.1.200.

And it will populate its ARP cache with the MAC address information.

> although the router doesn't do network address
> translation,i knew that, the router is still a hardware, so the router
> will replace source MAC address of this ping message with its own MAC
> address and vice versa when the destination send back the reply
> message. then i wonder why i can get its MAC address by using arp -a
> after that?
> any ideas?

If you had messed with your routing table, either eliminating the connected
interface route

C:\> route delete 192.168.1.0 192.168.1.127

or adding a more specific route to the destination using an intervening
router

C:\> route add 192.168.1.200 192.168.1.1

then you could achieve at least part of the effect you describe.

If the target workstation were in a different IP subnet on the
same logical Ethernet or if you addressed the target workstation using
a NAT address in a different IP subnet then you could also have
router involvement in what would otherwise be a direct communication
path between the IP end points.

In article <1148375464.935454.44770@j55g2000cwa.googlegroups. com>,
"index" <mailtumengyu@gmail.com> wrote:

> a question happens to me! i'm on the same side of the router as the
> host i'm trying to reach, after i send a ping message, this message
> first reach the router, although the router doesn't do network address
> translation,i knew that, the router is still a hardware, so the router
> will replace source MAC address of this ping message with its own MAC
> address and vice versa when the destination send back the reply
> message. then i wonder why i can get its MAC address by using arp -a
> after that?
> any ideas?

If you're on the same side of the router as the host you're trying to
reach, you don't need to go through the router. You just talk directly
to it on the local LAN.

If you're talking about a home broadband router, those are actually two
devices in one: a NAT router a LAN switch. When communicating between
two local LAN hosts, you're just going through the switch. So no MAC
changes take place.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***