3.  As defined in RFC 826 ARP consists of the following messages ■ ARP Request ■ ARP Reply

4.  The ARP or Neighbor Cache

6. A 2-byte field that indicates the type of hardware being used at the Network Interface Layer.

7. A 2-byte field that indicates the protocol for which ARP is providing address resolution. ARP Protocol Type is set to 0x0800.

8. A 1-byte field that indicates the length in bytes of the hardware address in the Sender Hardware Address and Target Hardware Address fields.

9. A 1-byte field that indicates the length in bytes of the protocol address in the Sender Protocol Address and Target Protocol Address fields.

10. A 2-byte field that indicates the type of ARP frame.

11. A field that is the length of the value of the Hardware Address Length field and contains the hardware or Data Link Layer address of the ARP frame’s sender.

12. A field that is the length of the value of the Protocol Address Length field and contains the protocol address of the ARP frame’s sender.

13. A field that is the length of the value of the Hardware Address Length field and contains the hardware or Data Link Layer address of the ARP frame’s target (destination).

14. A field that is the length of the value of the Protocol Address Length field and contains the protocol address of the ARP frame’s target (destination).

17. The Neighbor Cache

18. ARP also is used to perform duplicate address detection by sending an ARP Request in which the TPA is set to the IP address for which duplication is being detected.

19. ARP in previous versions of Windows added entries to the ARP cache and refreshed their lifetime when they were used without regard to whether the neighboring node was actually reachable, was receiving the packets sent to it, and was able to respond. Neighbor unreachability detection in Windows Server 2008 and Windows Vista is the process by which a node determines that the IP layer of a neighbor is no longer receiving packets.

20. By default, TCP/IP for Windows Server 2008 and Windows Vista use the Ethernet II encapsulation when sending both IP and ARP frames. The TCP/IP protocol for Windows Server 2008 and Windows Vista receives both Ethernet II and IEEE 802.3 Sub- Network Access Protocol (SNAP)–encapsulated frames, but, by default, they respond only with Ethernet II–encapsulated frames. To send IEEE 802.3 SNAP-encapsulated IP and ARP frames, use the ArpUseEtherSNAP registry value.

21. InARP is used to resolve the IP address on the other end of a virtual circuit based on a known Frame Relay DLCI. As RFC 2390 describes, InARP was designed specifically for frame relay virtual circuits. Frame relay link management protocols such as Local Management Interface (LMI) determine which virtual circuits are in use over the physical connection to the frame relay service provider. Once the DLCIs are determined, InARP is used to query each virtual circuit to determine the IP address of the interface on the other end. The responses are used to build a table of entries consisting of [DLCI, next-hop IP address].

22. Proxy ARP is the answering of ARP Requests on behalf of another node. As RFC 925 describes, Proxy ARP is used in situations in which a subnet is divided without the use of a router. A proxy ARP device is placed between nodes on the same subnet. The proxy ARP device is aware of which nodes are available on which segment. The proxy ARP device also answers ARP Requests and facilitates the forwarding of unicast IP packets for communication between nodes on separate segments.

23. ARP is used as a translation layer between Internet Layer addresses and Network Interface Layer addresses. ARP on LAN links is used to resolve the next-hop IP address of a node to its corresponding MAC address, to detect IP address conflicts, and to determine neighbor reachability. InARP on Frame Relay links is used to map a DLCI value to the IP address of the node on the other end of the virtual circuit. Proxy ARP is used to subdivide an IP subnet and provide transparent communication without using an IP router.