ARP: Address Resolution Protocol Surasak Sanguanpong nguan@ku.ac.th http://www.cpe.ku.ac.th/~nguan Last updated: July 3, 2002

Agenda Introduction to ARP ARP functionality Proxy ARP RARP

ARP protocol ARP maps any network level address (such as IP address) to its corresponding data link address (such as Ethernet address) TELNET FTP SMTP HTTP NNTP X-window DNS SNMP NFS TFTP BOOTP Others TCP UDP IP ICMP IGMP ARP RARP RFC 826 - Ethernet Address Resolution Protocol (STD0037) ARP is a supported protocol in the data link layers, not data link layer protocol

ARP and RARP ARP and RARP perform dynamic mapping between logical addresses and physical addresses Logical address physical address ARP Address Resolution Protocol ARP maps a logical address to a physical address i.e., IP address to Ethernet address RARP maps a physical address to a logical address i.e., Ethernet address to IP address physical address Logical address RARP TCP/IP uses the Address Resolution Protocol (ARP) and the Reverse Address Resolution Protocol (RARP) to initialize the use of Internet addressing on an Ethernet or other network that uses its own media access control (MAC). ARP allows a host to communicate with other hosts when only the Internet address of its neighbors is known. Before using IP, the host sends a broadcast ARP request containing the Internet address of the desired destination system. Reverse Address Resolution Protocol

Ethernet frame 158.108.1.2 need to know the Ethernet address of 158.108.1.10 00:10:4B:13:0A:BC 158.108.1.2 need to know the Ethernet address of 158.108.1.10 to create the complete Ethernet frame ?? 8:0:20:7a:49:68 type ………. 158.108.1.2 158.108.1.10 …. Destination Address Source Address IP source address IP destination Address Ethernet Header IP Datagram Ethernet Frame

ARP in operation A want to resolve MAC address of D 158.108.1.2 8:0:20:7a:49:68 158.108.1.5 00:10:4B:13:0A:BC A want to resolve MAC address of D A sends a broadcast ARP request A B C D ARP request who has IP 158.108.1.5? 158.108.1.2 8:0:20:7a:49:68 158.108.1.5 00:10:4B:13:0A:BC D sends a unicast ARP reply to A A B C D ARP reply me! with 00:10:4B:13:0A:BC

ARP mechanisms Each node maintains the ARP cache it first looks in the cache to find entry first if the entry is not used for a period (~15 minutes), it is deleted. Receive node can adds an MAC addr entry for source station in its own cache. ARP traffic load hosts quickly add cache entries. If all hosts on a subnet are booted at the same time? => flurry of ARP requests and reply. ARP caches Internet-to-hardware station address mappings. When an interface requests a mapping for an address not in the cache, ARP queues the message that requires the mapping, and broadcasts a message on the associated network requesting the address mapping if the ether encapsulation method has been enabled for the interface. If a response is provided, the new mapping is cached and any pending message is transmitted. ARP queues at most one packet while waiting for a mapping request to be responded to; only the most recently ``transmitted'' packet is kept.

ARP as a command line % arp -a entry in ARP table % arp -a www.cpe.ku.ac.th (158.108.33.5) at 0:0:e8:15:cc:c % telnet cc : router.cpe.ku.ac.th (158.108.33.1) at 0:0:c:6:13:4a cc.cpe.ku.ac.th (158.108.33.2) at 2:60:8c:2e:b5:8b more entries added

ARP packet frame hdr ARP/RARP message datalink frame frame hdr ARP/RARP message Hardware type:16 Protocol type:16 hlen:8 plen:8 ARP Operation:16 Sender MAC addr (bytes 0-3) sender MAC addr (bytes 4-5) sender IP addr (bytes 0-1) sender IP addr (bytes 2-3) dest MAC addr (bytes 0-1) dest MAC addr (bytes 2-5) dest IP addr (bytes 0-3) 0 15 16 31

Header details hardware type : Ethernet=1 ARCNET=7, localtalk=11 protocol type : IP=0x800 hlen : length of hardware address, Ethernet=6 bytes plen : length of protocol address, IP=4 bytes ARP operation : ARP request = 1, ARP reply = 2 RARP request = 3, RARP reply = 4

ARP request packet Sample ARP request Ethernet packet 158.108.1.2 158.108.1.5 00:10:4B:13:0A:BC ARP request Sample ARP request Ethernet packet FF:FF:FF:FF:FF:FF dest MAC (broadcast) 02:60:8c:2e:b5:8b source MAC 0x806 ARP frame type 0x001 0x800 Ethernet / IP 0x06 0x04 0x01 MAC=6/ IP=4 /request 8:0:20:7a:49:68 source MAC 158.108.1.2 source IP 0:0:0:0:0:0 dest MAC (unknown) 158.108.1.5 dest IP CRC Ethernet CRC

ARP reply packet Sample ARP reply Ethernet packet 158.108.1.2 158.108.1.5 00:10:4B:13:0A:BC ARP reply Sample ARP reply Ethernet packet 8:0:20:7a:49:68 dest MAC (broadcast) 00:10:4B:13:0A:BC source MAC 0x806 ARP frame type 0x001 0x800 Ethernet / IP 0x06 0x04 0x02 MAC=6/ IP=4 /request 00:10:4B:13:0A:BC source MAC 158.108.1.5 source IP 8:0:20:7a:49:68 dest MAC (unknown) 158.108.1.2 dest IP CRC Ethernet CRC

Proxy ARP Useful when some nodes on a network cannot support subnet One node answers ARP request for another: Router R answers for Y IP: 158.108.33.2 MAC: 02:60:8c:2e:b5:8b IP:158.108.40.1 MAC: 00:00:e8:15:cb:0c IP:158.108.33.1 MAC: 00:00:0c:06:13:4a X Y X to Y request R R send 158.108.40.1 with 00:00:0c:06:13:4a Useful when some nodes on a network cannot support subnet X do not understand subnet, so it thinks that Y is on the same subnet Router must be configured to be a proxy ARP

RARP Reverse ARP : map MAC addr to IP addr For device that can not store IP, usually diskless workstations Need to setup server wit RARP table Use the same frame format 0x0835 for Ethernet RARP request operation 0x003 = RARP request 0x004 = RARP reply RARP can not operate across router, BOOTP is more spread