How would a MAC layer look into the MAC header if it is the one to put the MAC header onto the packet coming from upper layer (Network layer)? I am talking about the packet that a node sends out to other node. I am not talking about MAC layer's function after it "receives" the packet from other node. Please let me know how a MAC header is created by a node. It has to some how look at the IP header of the frame coming from above layer in order to append the MAC layer header (e.g. Destination MAC address) to the packet.
When the ARP query initially goes out, the sender is asking "What is that MAC address of the destination with this IP address?" Since the sending host has no idea of the destination MAC address, in ARP, that host sends the query with a broadcast MAC address. All 1s. So every host in the IP subnet is interrupted, and has to check whether it needs to respond to this query.
ND, instead, uses a multicast address for the query.
RFC 826 is not written in the clearest language, but here's the text you need to parse through. I broke it up in paragraphs to make it a little clearer (hopefully):
As a packet is sent down through the network layers, routing determines the protocol address of the next hop for the packet and on which piece of hardware it expects to find the station with the immediate target protocol address. In the case of the
10Mbit Ethernet, address resolution is needed and some lower layer (probably the hardware driver) must consult the Address Resolution module (perhaps implemented in the Ethernet support module) to convert the pair to a 48.bit Ethernet address.
"The Address Resolution module tries to find this pair in a table. If it finds the pair, it gives the corresponding 48.bit Ethernet address back to the caller (hardware driver) which then transmits the packet.
"If it does not, it probably informs the caller that it is throwing the packet away (on the assumption the packet will be retransmitted by a higher network layer), and generates an Ethernet packet with a type field of ether_type$ADDRESS_RESOLUTION. The Address Resolution module then sets the ar$hrd field to ares_hrd$Ethernet, ar$pro to the protocol type that is being resolved, ar$hln to 6 (the number of bytes in a 48.bit Ethernet address), ar$pln to the length of an address in that protocol, ar$op to ares_op$REQUEST, ar$sha with the 48.bit ethernet address of itself, ar$spa with the protocol address of itself, and ar$tpa with the protocol address of the machine that is trying to be accessed. It does not set ar$tha to anything in particular, because it is this value that it is trying to determine.
"It could set ar$tha to the broadcast address for the hardware (all ones in the case of the 10Mbit Ethernet) if that makes it convenient for some aspect of the implementation. It then causes this packet to be broadcast to all stations on the Ethernet cable originally determined by the routing mechanism."
RFC 2461 is much clearer. I guess the RFC wrirters learned to write more clearly over the years:
"Nodes accomplish address resolution by multicasting a Neighbor Solicitation that asks the target node to return its link-layer address. Neighbor Solicitation messages are multicast to the solicited-node multicast address of the target address. The target returns its link-layer address in a unicast Neighbor Advertisement message. A single request-response pair of packets is sufficient for both the initiator and the target to resolve each other's link-layer addresses; the initiator includes its link-layer address in the Neighbor Solicitation."