Cable Guy wrote: > > Background: All devices correctly configured with static IPs. > No multicast > involved. No trick static entries on any device in the network. > > Scenario: > 1. A PC host receives an ethernet II arp frame. Layer 3 drops > it.
I assume you mean the ARP process drops it. An ARP frame doesn't have a Layer 3 header. An ARP frame doesn't get passed to IP. Since ARP requests are sent as broadcasts, it's quite likely a PC would receive an ARP request where the Target IP Address in the ARP data is not associated with the PC, so the PC drops the frame. So this step is definitely possible.... > 2. A PC host receives a tcp frame. Layer 3 drops it. Entries in the ARP cache on a Cisco router last 4 hours. So a router could easily send a frame to a MAC address with the wrong IP address if the IP address on the PC host had been changed. The router wouldn't have sent an ARP request if the mapping were already in the ARP cache though. Did you mean step 1 and step 2 to be linked? The sender sends an ARP that is ignored and then sends a frame anyway? Is this question a treat or a trick? :-) I'm sure you have something trickier in mind than what I came up with, but I just can't think of anything else. I wracked my brains thinking about IP spoofing, NAT, Proxy ARP and can't think of anything. Of course software bugs could cause something like this, but that's probbaly not what you had in mind either. _______________________________ Priscilla Oppenheimer www.troubleshootingnetworks.com www.priscilla.com > > Questions: > Which of the above is possible/not possible? If so, describe > the frame and > the network layout for your scenario? If not, provide reasoning. > > #1 is not so difficult, it is meant to start your thinking for > #2. > > Cable Guy > > Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=56607&t=56600 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
