1. ARP: Address Resolution Protocol
Surasak Sanguanpong
Last updated: July 3, 2002

2. Agenda
Introduction to ARP
ARP functionality
Proxy ARP
RARP

3. ARP protocol
ARP maps any network level address (such as IP address) to its corresponding data link address (such as Ethernet address)
TELNET
FTP
SMTP
HTTP
NNTP
X-window
DNS
SNMP
NFS
TFTP
BOOTP
Others
TCP
UDP IP
ICMP
IGMP
ARP
RARP
RFC Ethernet Address Resolution Protocol (STD0037)
ARP is a supported protocol in the data link layers, not data link layer protocol

4. ARP and RARP
ARP and RARP perform dynamic mapping between logical addresses and physical addresses
Logical address
physical address
ARP
Address Resolution Protocol
ARP maps a logical address to a physical address
i.e., IP address to Ethernet address
RARP maps a physical address to a logical address
i.e., Ethernet address to IP address
physical address
Logical address
RARP
TCP/IP uses the Address Resolution Protocol (ARP) and the Reverse Address Resolution Protocol (RARP) to initialize the use of Internet addressing on an Ethernet or other network that uses its own media access control (MAC). ARP allows a host to communicate with other hosts when only the Internet address of its neighbors is known. Before using IP, the host sends a broadcast ARP request containing the Internet address of the desired destination system.
Reverse Address Resolution Protocol

5. Ethernet frame 158.108.1.2 need to know the Ethernet address of
00:10:4B:13:0A:BC
need to know the Ethernet address of
to create the complete Ethernet frame ??
8:0:20:7a:49:68
type
………. ….
Destination
Address
Source
Address
IP source
address
IP destination
Address
Ethernet Header
IP Datagram
Ethernet Frame

6. ARP in operation A want to resolve MAC address of D
8:0:20:7a:49:68
00:10:4B:13:0A:BC
A want to resolve MAC address of D
A sends a broadcast ARP request A B C D
ARP request
who has IP ?
8:0:20:7a:49:68
00:10:4B:13:0A:BC
D sends a unicast ARP reply to A A B C D
ARP reply
me! with 00:10:4B:13:0A:BC

7. ARP mechanisms Each node maintains the ARP cache
it first looks in the cache to find entry first
if the entry is not used for a period (~15 minutes), it is deleted.
Receive node can adds an MAC addr entry for source station in its own cache.
ARP traffic load
hosts quickly add cache entries.
If all hosts on a subnet are booted at the same time? => flurry of ARP requests and reply.
ARP caches Internet-to-hardware station address mappings. When an interface requests a mapping for an address not in the cache, ARP queues the message that requires the mapping, and broadcasts a message on the associated network requesting the address mapping if the ether encapsulation method has been enabled for the interface. If a response is provided, the new mapping is cached and any pending message is transmitted. ARP queues at most one packet while waiting for a mapping request to be responded to; only the most recently ``transmitted'' packet is kept.

8. ARP as a command line % arp -a
entry in ARP table
% arp -a
( ) at 0:0:e8:15:cc:c
% telnet cc :
router.cpe.ku.ac.th ( ) at 0:0:c:6:13:4a
cc.cpe.ku.ac.th ( ) at 2:60:8c:2e:b5:8b
more entries added

9. ARP packet frame hdr ARP/RARP message
datalink frame
frame hdr ARP/RARP message
Hardware type: Protocol type:16
hlen: plen: ARP Operation:16
Sender MAC addr (bytes 0-3)
sender MAC addr (bytes 4-5) sender IP addr (bytes 0-1)
sender IP addr (bytes 2-3) dest MAC addr (bytes 0-1)
dest MAC addr (bytes 2-5)
dest IP addr (bytes 0-3)

10. Header details hardware type : Ethernet=1 ARCNET=7, localtalk=11
protocol type : IP=0x800
hlen : length of hardware address, Ethernet=6 bytes
plen : length of protocol address, IP=4 bytes
ARP operation : ARP request = 1, ARP reply = RARP request = 3, RARP reply = 4

11. ARP request packet Sample ARP request Ethernet packet 158.108.1.2
00:10:4B:13:0A:BC
ARP request
Sample ARP request Ethernet packet
FF:FF:FF:FF:FF:FF
dest MAC (broadcast)
02:60:8c:2e:b5:8b
source MAC
0x806
ARP frame type
0x001
0x800
Ethernet / IP
0x06
0x04
0x01
MAC=6/ IP=4 /request
8:0:20:7a:49:68
source MAC
source IP
0:0:0:0:0:0
dest MAC (unknown)
dest IP
CRC
Ethernet CRC

12. ARP reply packet Sample ARP reply Ethernet packet 158.108.1.2
00:10:4B:13:0A:BC
ARP reply
Sample ARP reply Ethernet packet
8:0:20:7a:49:68
dest MAC (broadcast)
00:10:4B:13:0A:BC
source MAC
0x806
ARP frame type
0x001
0x800
Ethernet / IP
0x06
0x04
0x02
MAC=6/ IP=4 /request
00:10:4B:13:0A:BC
source MAC
source IP
8:0:20:7a:49:68
dest MAC (unknown)
dest IP
CRC
Ethernet CRC

13. Proxy ARP Useful when some nodes on a network cannot support subnet
One node answers ARP request for another: Router R answers for Y
IP:
MAC: 02:60:8c:2e:b5:8b
IP:
MAC: 00:00:e8:15:cb:0c
IP:
MAC: 00:00:0c:06:13:4a X Y
X to Y request R
R send with 00:00:0c:06:13:4a
Useful when some nodes on a network cannot support subnet
X do not understand subnet, so it thinks that Y is on the same subnet
Router must be configured to be a proxy ARP

14. RARP Reverse ARP : map MAC addr to IP addr
For device that can not store IP, usually diskless workstations
Need to setup server wit RARP table
Use the same frame format
0x0835 for Ethernet RARP request
operation 0x003 = RARP request x004 = RARP reply
RARP can not operate across router, BOOTP is more spread