An overview of the

ARP provides dynamic mapping between IP addresses and hardware addresses. RARP is used by systems that do not have disk drives and requires manual Settings by system administrators.

ARP working process

  • ARP sends an Ethernet data frame called an ARP request to each host on the Ethernet. This process is called broadcast, and the ARP request data frame contains the IP address of the destination host, saying “If you are the owner of this IP address, please answer your hardware address.”
  • After receiving the broadcast, the ARP layer of the destination host recognizes that the sender is asking for its IP address and sends an ARP reply. The ARP reply contains the IP address and the corresponding hardware address.
  • After receiving an ARP reply, the IP datagrams that enable ARP to do request-reply exchange can now be transmitted.

Point-to-point links (PPP) do not use ARP.

ARP cache

This is the key to efficient ARP: there is an ARP tell cache on each host. This cache holds the most recent mapping between Internet addresses and hardware addresses.

Run the arp-a command to view the contents of the cache:

# arp -a? (10.200.100.1) at 9C :6:1b:5:c7:f8 on en0 ifscope [Ethernet]? (10.200.100.10) at C8 :ff: 28:5C: 6E: 1D on en0 ifscope [Ethernet]? (10.200.100.55) at 2c: 6F: C9:6 :ae: 5F on en0 ifscope [Ethernet]? (10.200.100.57) at c0:d0:12:D6:28:6C on en0 ifscope [Ethernet]? (10.200.100.71) at D0:25:98:3A: c0:C8 on en0 ifscope [Ethernet]? (10.200.100.198) at A0:99:9b :f:7a: 9F on en0 ifscope [Ethernet]? (10.200.100.204) at C8:F6:50:1:A4: E7 on en0 ifscope [Ethernet]? (10.200.100.252) at 34: E1 :2d:6b:33: Ed on en0 ifscope [Ethernet]? (10.200.101.137) at AC: E0:10:27:2D :bf on en0 ifscope [Ethernet]Copy the code

ARP Packet Format

  • Hardware type: indicates the type of hardware interface that the sender wants to know. The value of Ethernet is 1.
  • Protocol type: indicates the high-level protocol type provided by the sender. The IP address is 0800 (hexadecimal).
  • Hardware address length and protocol length: Indicates the length of the hardware address and high-level protocol address. In this way, ARP packets can be used on networks of any hardware and any protocol.
  • Operation type: indicates the type of the packet. ARP request is 1, ARP response is 2, RARP request is 3, and RARP response is 4.
  • Sender hardware address (0-3 bytes) : the first 3 bytes of the source host hardware address.
  • Sender hardware address (4-5 bytes) : the last 3 bytes of the source host hardware address;
  • Sender IP address (0-1 bytes) : the first two bytes of the source host hardware address.
  • Sender IP address (2-3 bytes) : the last 2 bytes of the source host hardware address.
  • Destination hardware address (0-1 bytes) : the first two bytes of the destination host hardware address.
  • Destination hardware address (2-5 bytes) : the last 4 bytes of the destination host hardware address. Destination IP Address (0-3 bytes) : indicates the IP address of the destination host.

ARP proxy

If an ARP request is sent from a host on one network to a host on another network, the routers connected to the two networks can answer the request. This process is called Proxy ARP or ARP Proxy ARP. In this way, the sender of an ARP request can fool the sender into thinking that the router is the destination host. In fact, the destination host is on the other side of the router. A router functions as a proxy for the destination host, forwarding packets to it from other hosts.

RARP works

1. Each device on the network has a unique hardware address, usually a MAC address assigned by the device manufacturer. PC1 reads the MAC address from the nic and sends an RARP request broadcast packet over the network, asking the RARP server to reply to the IP address of the PC. 2. The RARP server receives the RARP request packet, assigns an IP address to it, and sends the RARP response to PC1. 3. PC1 receives an RARP response and uses the obtained IP address to communicate.

summary

ARP is an underlying protocol in most TCP/IP implementations, but its operation is generally transparent to application or system administrators. ARP tells cache is very important in its running process, we can use ARP command to check and operate cache. Each item in the cache has a timer that is used to delete incomplete and complete entries.

References:

  1. ARP (Address Resolution Protocol)
  2. Reverse address translation protocol