Address Resolution Protocol (ARP) is used to map IP addresses to MAC addresses. That is, it queries the MAC Address of the target IP Address.
The working process of the
When host A wants to communicate with host B, the IP address resolution protocol resolves the IP address of host B into the MAC address of host B. The following is the workflow:
- Based on the routing table on host A, IP determines the forwarding IP address used to access host B. Host A then checks host B’s matching MAC address in its local ARP cache.
- If host A does not find A mapping in the ARP cache, it will ask for the hardware address corresponding to B’s IP address, thereby broadcasting the ARP request frame to all hosts on the local network. The IP address and MAC address of source host A are included in the ARP request. Each host on the local network receives the ARP request and checks if it matches its OWN IP address. If the host finds that the requested IP address does not match its own IP address, it discards the ARP request.
- Host B determines that the IP address in the ARP request matches its own IP address, and then adds the IP address and MAC address mapping of host A to the local ARP cache.
- Host B directly sends an ARP reply message containing its MAC address to host A.
- When host A receives an ARP reply message from host B, host A updates the ARP cache with the IP address and MAC address mapping of host B. The native cache has a lifetime, typically 20 minutes, after which the process is repeated again. Once the MAC address of host B is determined, host A can send IP communication to host B.
ARP table entry
- C: Indicates that arp entries are dynamically obtained through ARP requests and can be overwritten
- M: Indicates that the ARP entry is set manually and is permanent
- P: Publish, which indicates that the ARP entry can be used to restore ARP requests from other hosts. (Used for ARP proxy)
ARP frame format
Message Ethernet Frame (64 bytes)
| Front sync code * | Frame start delimiter * | The source MAC address | Destination MAC Address | ARP Packet Type | Message content | Padding | CRC |
|---|---|---|---|---|---|---|---|
| 7 bytes * | 1 byte * | 6 bytes | 6 bytes | 2 bytes (0 x0806) | 28 bytes | 18 bytes | 4 bytes |
ARP request packets are broadcast packets, and the destination MAC address of Ethernet frames is FF:FF:FF:FF:FF.
Packet content (28 bytes)
The following uses IPv4 address resolution as an example
| field | The length of the | meaning |
|---|---|---|
| Hardware types | 2 – | Indicates the type of network on which ARP packets can be transmitted. If the value is 1, it indicates Ethernet |
| Protocol type | 2 – | Hardware Address Indicates the protocol address type to be mapped. The value of mapped IPv4 address is 0x0800 |
| MAC Address Length | 1 byte | Indicates the length of a MAC address, in bytes. The value is 6 |
| IP Address Length | 1 byte | Indicates the length of an IPv4 address, in bytes. The value is 4 |
| Operation type | 2 – | Specify the ARP packet type. 1 indicates an ARP request packet, and 2 indicates an ARP reply packet |
| The source MAC address | 6 bytes | Hardware address of the sending device |
| The source IP address | 4 bytes | IP address of the sender device |
| Destination MAC Address | 6 bytes | The hardware address of the receiving device is 00:00:00:00:00 in the ARP request packet, which is unknown |
| Destination IP address | 4 bytes | IP address of the receiving party |
Which layer does ARP belong to?
- The function of ARP is to obtain MAC information and serve the link layer. In this regard, ARP is a link layer protocol
- Both ARP and IP protocols are encapsulation based on Ethernet frame protocol. They have independent Type in Ethernet frame protocol. The former is 0x0806, and the latter is 0x0800