The Address Resolution Protocol (ARP) is a computer networking protocol to find out the MAC address (Physical address) of a device when the IP address (Logical address) is known. This is predominantly used in Local Area Network (LAN) environments as well as routing data traffic based on IP addresses when the next hop router must be known. The diagram below illustrates how ARP functions
1. Host A wants to send a packet destined to 192.168.1.9
but does not know the MAC address of the device
2. Host A then sends an ARP request to all hosts (BROADCAST)
which is forwarded to the Switch A connected to all hosts
3. Switch A looks at the destination MAC address in the packet and broadcasts the packet to all hosts on the LAN except Host A
4. Host B and Host D receive the packet and just update their ARP table with the IP address of Host A and its MAC address
5. Host C updates its ARP table and notices its IP address in the destination IP address field and sends an ARP reply which is unicast back to the source MAC address of Host A
6. Host A receives the ARP reply and updates its ARP table and then sends the required packet unicast to Host C
Originally part of RFC 826 defined in 1982. Although ARP has been used in many types of networks such as IP, DECNET, Token Ring, FDDI and other Ethernet Technologies, today it is predominantly used to translate IP addresses to Ethernet MAC addresses because of the prevalence of IPV4 and Ethernet in general. It is generally reference under layer 2 (data link) and layer 3 (network) of the OSI networking model.
ARP functions as a low level request and response protocol that is sent across the media access level of the underlying network. In case of Ethernet systems, ARP disguises itself in the payload of the Ethernet packet (see below)
ARP announcements
Sometimes ARP may be used for announcement purposes. For example, if the IP address or MAC address changes due to a changed Network Card, DHCP lease expiring, etc. The host signals that to the rest of the network by sending out a Gratuitous ARP message broadcast. This type of an announcement is just for the information of the other hosts so that they can update their ARP table and is not send with the intention of receiving a reply. It is also used during MAC address change in Network Interface card (NIC) Teaming, High availability clusters.
ARP probe
A host broadcasts ARP probe packets all around the network before it begins using an IPV4 address (manually assigned, DHCP assigned). This is done to test if the address is already in use and is accomplished by sending out an ARP request constructed with a 0.0.0.0 (all-zero) source IP address.
Comments