rodney hamilton

From time to time we find ourselves in a situation where we need to convert
a network printer to a parallel printer connected to a hardware print server
(like an HP JetDirect). When we do this, we try to set the IP of the print
server to be the same as the original printer, but the MAC address change
causes some temporary problems. Sometimes this is a simple matter of
clearing an ARP table somewhere, but sometimes finding the right table, and
someone who can get to it isn't so simple.

So, the thought crosses my mind... If I create a program that generates a
ping packet with the right source MAC and IP addresses, maybe that will
cause the offending ARP table to update without physically touching the
machine that it's on. On the way to that goal, I came across this odd
behavior.

Start with two machines A & B (both NT4). Neither machine has the other's
IP address in it's ARP table. If I ping machine A from machine B, both ARP
tables update with the other machine's address information. (like I'd
expect) Now add simulated machine C. I can send a ping packet with a
fictitious source IP and MAC address and machine A's destination address,
but never receive a reply and never see the ARP table update. But, if I
manually add the ARP entry on machine A for the simulated IP/MAC address,
the replies come back just fine.

I've compared the two packets byte-by-byte, and I can't see any reason for
one to behave differently than the other. I thought that there might be
some other network communication preceding the machine B ping that paved the
way, but packet sniffing shows nothing. Any thoughts?