Managing NFS and NIS, 2nd Edition - Mike Eisler [180]
Table 13-6. Ethernet address prefixes
Prefix
Vendor
Prefix
Vendor
Prefix
Vendor
00:00:0c
Cisco
00:20:85
3Com
00:e0:34
Cisco
00:00:3c
Auspex
00:20:af
3Com
00:e0:4f
Cisco
00:00:63
Hewlett-Packard
00:60:08
3Com
00:e0:a3
Cisco
00:00:65
Network General
00:60:09
Cisco
00:e0:f7
Cisco
00:00:69
Silicon Graphics
00:60:2f
Cisco
00:e0:f9
Cisco
00:00:f8
DEC
00:60:3e
Cisco
00:e0:fe
Cisco
00:01:fa
Compaq
00:60:47
Cisco
02:60:60
3Com
00:04:ac
IBM
00:60:5c
Cisco
02:60:8c
3Com
00:06:0d
Hewlett-Packard
00:60:70
Cisco
08:00:02
3Com
00:06:29
IBM
00:60:83
Cisco
08:00:09
Hewlett-Packard
00:06:7c
Cisco
00:60:8c
3Com
08:00:1a
Data General
00:06:c1
Cisco
00:60:97
3Com
08:00:1b
Data General
00:07:01
Cisco
00:60:b0
Hewlett-Packard
08:00:20
Sun Microsystems
00:07:0d
Cisco
00:80:1c
Cisco
08:00:2b
DEC
00:08:c7
Compaq
00:80:5f
Compaq
08:00:5a
IBM
00:10:11
Cisco
00:90:27
Intel
08:00:69
Silicon Graphics
00:10:1f
Cisco
00:90:b1
Cisco
08:00:79
Silicon Graphics
00:10:2f
Cisco
00:a0:24
3Com
10:00:5a
IBM
00:10:4b
3Com
00:aa:00
Intel
10:00:90
Hewlett-Packard
00:10:79
Cisco
00:c0:4f
Dell
10:00:d4
DEC
00:10:7b
Cisco
00:c0:95
Network Appliance
3C:00:00
3Com
00:10:f6
Cisco
00:e0:14
Cisco
aa:00:03
DEC
00:20:35
IBM
00:e0:1e
Cisco
aa:00:04
DEC
ARP, the Address Resolution Protocol, is used to maintain tables of 32- to 48-bit address translations. The ARP table is a dynamic collection of MAC-to-IPv4 address mappings. To fill in the MAC-level Ethernet packet headers, the sending host must resolve the destination IPv4 address into a 48-bit address. The host first checks its ARP table for an entry keyed by the IPv4 address, and if none is found, the host broadcasts an ARP request containing the recipient's IPv4 address. Any machine supporting ARP address resolution responds to an ARP request with a packet containing its MAC address. The requester updates its ARP table, fills in the MAC address in the Ethernet packet header, and transmits the packet.
If no reply is received for the ARP request, the transmitting host sends the request again. Typically, a delay of a second or more is inserted between consecutive ARP requests to prevent a series of ARP packets from saturating the network. Flurries of ARP requests sometimes occur when a malformed packet is sent on the network; some hosts interpret it as a broadcast packet and attempt to get the Ethernet address of the sender via an ARP request. If many machines are affected, the ensuing flood of network activity can consume a considerable amount of the available bandwidth. This behavior is referred to as an ARP storm, and is most frequently caused by an electrical problem in a transceiver that damages packets after the host has cleanly written them over its network interface.
To examine the current ARP table entries, use arp -a:
% arp -a
Net to Media Table: IPv4
Device IP Address Mask Flags Phys Addr
------ -------------------- --------------- ----- ---------------
hme0 caramba 255.255.255.255 08:00:20:b9:2b:f6
hme1 socks 255.255.255.255 08:00:20:e7:91:5d
hme0 copper 255.255.255.255 00:20:af:9d:7c:92
hme0 roger 255.255.255.255 SP 08:00:20:a0:33:90
hme0 universo 255.255.255.255 U
hme0 peggy 255.255.255.255 SP 08:00:20:81:23:f1
hme1 duke 255.255.255.255 00:04:00:20:56:d7
hme0 224.0.0.0 240.0.0.0 SM 01:00:5e:00:00:00
hme1 224.0.0.0 240.0.0.0 SM 01:00:5e:00:00:00
hme1 daisy 255.255.255.255 08:00:20:b5:3d:d7
The arp -a output listing reports the interface over which the ARP notification arrived, the IP address (or hostname) and its Ethernet address mapping. The unresolved entry (denoted by the U flag) is for a host that did not respond to an ARP request; after several minutes the entry is removed from the table. Complete entries in the ARP table may be static or dynamic, indicating how the address mappings were added and the length of their expected