CISCO NETWORKING ACADEMY Chabot College ELEC Address Resolution Protocol

CISCO NETWORKING ACADEMY ARP Layer 2 (MAC) address processing –Performed in NIC hardware –Fast –Low CPU overhead Layer 3 (IP) address processing –Performed in software –Slow –High CPU overhead

CISCO NETWORKING ACADEMY ARP Problem: Layer 3 knows the network address that a message should be sent to... But layer 3 has no ability to actually send a message over the media!

CISCO NETWORKING ACADEMY ARP To send, Layer 3 needs the services of Layer 2. To use those services, there must be a way to tie Layer 3 (IP) addresses to Layer 2 (MAC) addresses

CISCO NETWORKING ACADEMY ARP Address Resolution Protocol, or ARPAddress Resolution Protocol, or ARP, is used to “map” IP addresses to MAC addresses.

CISCO NETWORKING ACADEMY The ARP Table

CISCO NETWORKING ACADEMY The ARP Table The ARP table is stored in area of Random- Access Memory on each host. ARP cacheSuch an area of memory is often called a cache. The ARP table is often referred to as an ARP cache. Entries in the ARP table “age out.” They are removed from the table after a period of inactivity.

CISCO NETWORKING ACADEMY The ARP Table Examine your curriculum PC’s arp table now. Start | Programs | MS-DOS Prompt At the prompt, type arp -a

CISCO NETWORKING ACADEMY The ARP Table Examine your curriculum PC’s arp table now. Start | Programs | MS-DOS Prompt At the prompt, type arp -a Microsoft(R) Windows 98 (C)Copyright Microsoft Corp C:\WINDOWS>arp -a

CISCO NETWORKING ACADEMY The ARP Table You may see one or more entries in your PC’s arp table: Microsoft(R) Windows 98 (C)Copyright Microsoft Corp C:\WINDOWS>arp -a Interface: on Interface 0x Internet Address Physical Address Type a0-c5-e2-ad-b8 dynamic C:\WINDOWS>

CISCO NETWORKING ACADEMY The ARP Table Or you may find that your PC’s arp cache is empty: Why might it be empty? Aging... Microsoft(R) Windows 98 (C)Copyright Microsoft Corp C:\WINDOWS>arp -a No ARP Entries Found

CISCO NETWORKING ACADEMY Aging Out For Microsoft Windows hosts: Initial mappings have a 2-minute “time-to-live”. An entry that is used twice in 2 minutes is automatically given a 10-minute time-to-live.

CISCO NETWORKING ACADEMY ARP Problem: The IP address of a host is known, but it’s MAC address is not. How can IP learn the MAC addresses of a host?

CISCO NETWORKING ACADEMY ARP Solution: IP issues an ARP request

CISCO NETWORKING ACADEMY Sending Messages The use of ARP depends on the message destination: –1. Local destination - the source and destination hosts are on the same network segment. –2. Remote destination - source and destination are on different network segments.

CISCO NETWORKING ACADEMY Sending Example: Local From Network A, Host 1 To Network A, Host 3

CISCO NETWORKING ACADEMY Sending Example: Local From Network A, Host 1 To Network A, Host 3 Source & destination IP address are on the same subnet:

CISCO NETWORKING ACADEMY Sending Example: Local Step One: Is the IP address in the ARP cache? –If yes, use the cached MAC address to address the message. –If no, go to Step 2...

CISCO NETWORKING ACADEMY Sending Example: Local Step Two: (when there is no ARP entry) ARP requestSend ARP request to find MAC address of destination. The ARP Request is a layer-2 broadcast frame. Therefore, each computer on the network –accepts the frame –passes it up to layer 3 to determine if it is the owner of the requested IP address.

CISCO NETWORKING ACADEMY Sending Example: Local Step Three: (performed by just one computer) ARP Reply is sent directly to the hardware address of the requesting system. Note - Only the owner of the requested IP address will provide the ARP reply. All other hosts disregard the request.

CISCO NETWORKING ACADEMY Sending Example: Local Step Four: Upon receiving the reply, the requesting machine will add the address into its ARP cache and use the newly discovered MAC address to address the message.

CISCO NETWORKING ACADEMY Sending Example: Remote From Network A, Host 1 To Network B, Host 1

CISCO NETWORKING ACADEMY Sending Example: Remote From Network A, Host 1 To Network B, Host 1 Source & destination IP address are not on the same subnet:

CISCO NETWORKING ACADEMY Sending Example: Remote Step One: Is the IP address local (same subnet)? No. router To leave a subnet or network, a computer must use the services of a router. gateways Routers are sometimes called gateways for this reason.

CISCO NETWORKING ACADEMY Default Gateway Default Gateway: Default Gateway: the network interface (of a router) to which the client sends traffic that is destined for other networks.

CISCO NETWORKING ACADEMY Sending Example: Remote Step Two: Sending computer checks for a default gateway in its TCP/IP configuration. If no default gateway is installed, the sending computer cannot send the message.

CISCO NETWORKING ACADEMY Sending Example: Remote Step Three: Sending computer checks ARP table for IP and MAC address of default gateway. If there is no ARP entry for the default gateway, the sending computer sends an ARP request, looking for the router.

CISCO NETWORKING ACADEMY Sending Example: Remote Step Four: Gateway router sends ARP Reply directly to the hardware address of the requesting system. Note - Only the router will provide the ARP reply. All other hosts disregard the request.

CISCO NETWORKING ACADEMY Sending Example: Remote Step Five: Sending computer addresses message using non-local destination hosts’s IP, but uses default gateway’s MAC address. (The computer will always use the MAC address of the default gateway when addressing messages to hosts on a remote IP network.)

CISCO NETWORKING ACADEMY Sending Summary Local Destination... –IP address - destination host –MAC address - destination host Remote Destination... –IP address - destination host –MAC address - default gateway of router

CISCO NETWORKING ACADEMY Proxy ARP A rarely used variation of ARP. Used only between subnets of the same net. Hosts are configured to view all subnets as a single network. This is typically done by configuring the workstation with a smaller subnet mask than the network really uses. The hosts don’t know there is a router between them and the destination host. The hosts don’t have a default gateway defined. Proxy ARP occurs when the router is configured to send an ARP reply to the requesting host on behalf of the destination host. The router gives its own MAC address in the ARP reply.

CISCO NETWORKING ACADEMY Proxy ARP Exam question says: In Proxy ARP, a router helps a device on one subnet to find the MAC address of a host on another subnet. This is the “correct” answer, but it isn’t true. Actually the router gives its own MAC address. Rarely used. Only important for the exam. For technical detail, follow this link...this link...

CISCO NETWORKING ACADEMY Router’s ARP table Usually bigger than workstation’s table Can have addresses from more than one network Includes what interface or port that network is connected to in the table

CISCO NETWORKING ACADEMY Router’s ARP table Protocol Address Age (min) Hardware Addr Interface Internet e d Ethernet0 Internet c77.01f4 Ethernet0 Internet e0.24e7.bc43 Ethernet1 Internet e0.ff Ethernet1

CISCO NETWORKING ACADEMY Duplicate IP Addresses How would ARP behave if two hosts were accidentally assigned the same IP address?

CISCO NETWORKING ACADEMY Duplicate IP Addresses Two MAC addresses would be mapped to the same IP address - a forbidden condition!

CISCO NETWORKING ACADEMY ARP Quiz Sending from NetA Host1 to NetC Host 2 Which MAC addresses must be known or discovered with ARP?

CISCO NETWORKING ACADEMY ARP Quiz Which MAC addresses must be known? Default Gateway of Network A

CISCO NETWORKING ACADEMY ARP Quiz Which MAC addresses must be known? Default Gateway of Network A Default Gateway of Network B

CISCO NETWORKING ACADEMY ARP Quiz Which MAC addresses must be known? Default Gateway of Network A Default Gateway of Network B Host 2 on Network C