Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
A routing puzzle for you
Question: is there ever a reason to ARP for an IP outside of any local subnets?
Update: I like @bmastenbrook's answer: https://twitter.com/bmastenbrook/status/1069415501296586752
# my subnet is a /24, and 10.0.10.10 is totally not on the same /24 as 10.0.0.42.
xomg% netstat -rn -f inet
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 10.0.10.10 UGScI 3 0 en0
10/24 link#8 UCS 0 0 en0 !
10.0.0.42/32 link#8 UCS 0 0 en0 !
10.0.10.10/32 link#8 UCS 1 0 en0 !
10.0.10.10 link#8 UHLWIir 1 0 en0 !
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 1 10797 lo0
169.254 link#8 UCS 0 0 en0 !
224.0.0/4 link#8 UmCS 1 0 en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en0
255.255.255.255/32 link#8 UCS 0 0 en0 !
# A view from SystemConfiguration:
xomg% networksetup -getinfo "Wi-Fi"
Manual Configuration
IP address: 10.0.0.42
Subnet mask: 255.255.255.0
Router: 10.0.10.10
IPv6: Off
Wi-Fi ID: 8c:85:90:8d:48:11
# no funny business
xomg% networksetup -getadditionalroutes "Wi-Fi"
There are no additional IPv4 routes on Wi-Fi.
# and yet, here is macOS ARPing for 10.0.10.10 (which happens when I attempt to ping a non-local IP):
xomg% sudo tcpdump -i all -e -q -n arp
tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on all, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
16:20:23.073750 8c:85:90:8d:48:11 > ff:ff:ff:ff:ff:ff, ARP, length 42: Request who-has 10.0.10.10 tell 10.0.0.42, length 28
16:20:24.074042 8c:85:90:8d:48:11 > ff:ff:ff:ff:ff:ff, ARP, length 42: Request who-has 10.0.10.10 tell 10.0.0.42, length 28
^C
2 packets captured
12 packets received by filter
0 packets dropped by kernel
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.