Address Resolution Protocol (ARP)
Use of Address Resolution Protocol (ARP) is necessary to begin host to host data transfer. This is because transfers on the physical layer take place source MAC ID to destination MAC ID. Ethernet uses the more media independent addressing protocol IP. A conversion needs to take place between the known IP address and the associated MAC ID. The source host sends an ARP REQUEST containing the source MAC ID and destination IP address. In actuality the ARP packet has much more data. For the sake of this discussion, only the MAC ID and IP addresses are covered. The owner of the requested IP address sees this broadcast and responds with and ARP REPLY containing its MAC ID. Datagram transactions can now take place using the physical layer source MAC ID to destination MAC ID. Communication is always a physical address to physical address. Though simple in form, this process is essential to all data transfers.Definition of ARP
"Address Resolution Protocol – The TCP/IP protocol used to dynamically bind high level IP address to a low level physical hardware address. ARP is used across a single physical network and is limited to networks that support hardware broadcast."
Internetworking with TCP/IP
Douglas E. Comer
So how does ARP work?
Take it that there is two machines on the network machine A and machine B, each have been assigned with an IP address, also note that each machine has its own unique physical address (MAC), the goal of ARP is to create a low-level software that hides the physical addresses and allows higher-level programs to work only with internet address. However communication must be carried out by physical networks using whatever physical address scheme the underlying network hardware supplied (DCHP or Static).
Suppose machine A sends a packet to machine B across a physical network to which they both are attached, but machine A only has machines B IP address (internet address), so how does machine A map that address across to machine B?
Address mapping must be performed at each step along a path from the original source to the ultimate destination. However Machine A must wait until it receives machine B’s final packet before transmitting its file across the physical address. This process is usually maintained by the networks router.
However sometimes this can be tricky, as mapping high-level addresses to physical addresses can be known as address resolution problems, but that can be resolved in several ways:
- Some machines keep tables in each machine that contains pairs of high-level and physical address
- Sometimes others resolve the problem by encoding the hardware addresses in high level addresses
But using either approach still makes high level addressing awkward at best.
So the source computer sends a request to the destination computer who then submits a reply.
The processes are:
| Source: Check the ARP cache Generate the ARP Broadcast ARP Process the ARP reply Update the ARP catch |
Destination: Process the ARP from the request Generate ARP reply Update the cache Send Reply |
ARP Commands
The ARP command displays the content of the ARP table. To display the entire ARP table using ARP use this command arp –a. If you require individual entries you can use the arp hostname command line.
As an example I used the ARP command on a Unix based machine:
| Net to Media Table: | IPv4 | |||
| Device | IP address | Mask | Flags | Phys Addr |
| Dnet0 | Rodent | 255.255.255.255 | 00:50:ba:3:f:c2:5e | |
| Dnet0 | Crab | 255.255.255.255 | SP | 00:00:c0:dd:d4:da |
| Dnet0 | 224.0.0.0 | 240.0.0.0 | SM | 01:00:5e:00:00:00 |
As you can see crab forwards data to rodent the table shows how datagram’s put data into Ethernet frames and sends them to Ethernet addresses (IP).
The entries in the table show that rodent was added dynamically as a result of queries by crab. However two entries are static entries added as a result of configuration of crab. We can tell this because in the flag column there is an S from static, the entry 224.0.0.0 is for all multicast addresses, the M in the flag column means mapping and is used only for the multicast entry, on a broadcast medium like Ethernet, the Ethernet broadcast address is used to make a final delivery to a multicast group.
The P flag in the crab entry stands for published, this means that the ATP query is received for the IP address of crab.
ARP tables normally don’t require any attention because they are built automatically by the ARP protocol which is very stable, however if things do go wrong the ARP table can be corrected by manually adjusting the table.
As you can see ARP or Address Resolution Protocol is a very in depth protocol, which related to all network hardware, however with the new version of internet protocols - IPv6 being released quite shortly will the new protocol NDP work the same or different?
NetBurner Network White Paper
Ethernet Communication
Address Resolution Protocol
TCP/IP addresses into MAC Address
Report written by Martin McCauley / B00444502
Comments: