1. 1 Network Administration Module 3 ARP/RARP

2. 2 Address Resolution The problem Physical networks use physical addresses, not IP addresses Need the physical address of the destination host The Solution Mapping of IP address to physical hardware address Performed by TCP/IPs Network Access Layer

3. 3 Physical Address / MAC Address The MAC address is a unique value associated with a network adapter / network card. MAC addresses are also known as hardware addresses or physical addresses. They uniquely identify an adapter on a LAN. MAC addresses are 12-digit hexadecimal numbers (48 bits in length). By convention, MAC addresses are usually written in one of the following two formats: MM:MM:MM:SS:SS:SS or MM-MM-MM-SS-SS-SS The first half of a MAC address contains the ID number of the adapter manufacturer. These IDs are regulated by an Internet standards body. The second half of a MAC address represents the serial number assigned to the adapter by the manufacturer.

4. 4 Why MAC addresses Recall that TCP/IP and other mainstream networking architectures generally adopt the OSI model. In this model, network functionality is subdivided into layers. MAC addresses function at the data link layer (layer 2 in the OSI model). They allow computers to uniquely identify themselves on a network (Local Area Network) at this relatively low level.

5. 5 MAC vs IP Address Whereas MAC addressing works at the data link layer, IP addressing functions at the network layer (layer 3). It's a slight over simplification, but one can think of IP addressing as supporting the software implementation and MAC addresses as supporting the hardware implementation of the network stack. The MAC address generally remains fixed and follows the network device, but the IP address changes as the network device moves from one network to another.

6. 6 MAC vs IP Address (Cont …) IP networks maintain a mapping between the IP address of a device and its MAC address. This mapping is known as the ARP cache or ARP table. ARP, the Address Resolution Protocol, supports the logic for obtaining this mapping and keeping the cache up to date.

7. 7 WHAT is ARP ARP- Address Resolution Protocol Performs IP to MAC address translation Maintains dynamic table of IP/MAC address pairs e.g. Request with 192.168.0.3 (32bits) Reply with 08:00:20:21:AA:56 (48 bits HEX)

8. 8 ARP Request (same subnet)

9. 9 ARP Reply

10. 10 ARP Process Requests are made to translate IP addresses ARP looks in its ARP Table If IP address is found, MAC address is returned If not found, ARP broadcasts request to network Receiving host then returns its Ethernet address IP/Ethernet address pair is cached in ARP table for future use

11. 11 ARP Requests Only published addresses are returned A host normally publishes and returns its own Ethernet address A host may return Ethernet address for other hosts Called Proxy ARP

12. 12 What is Ethernet Ethernet is a protocol that controls the way data is transmitted over a local area network (LAN). Ethernet Frame Format

13. 13 ARP Message Fields Hardware type(2 octets) Protocol type(2 octets) Hardware length(1 octet) Protocol length(1 octet) Operation(2 octets) Sender HA(6 octets) Sender IP(4 octets) Target HA(6 octets) Target IP(4 octets) Note: 1 octet is equal to 8 bits.

14. 14 CSMA/CD Short for Carrier Sense Multiple Access / Collision Detection, a set of rules determining how network devices respond when two devices attempt to use a data channel simultaneously (called a collision). Standard Ethernet networks use CSMA/CD to physically monitor the traffic on the line at participating stations. If no transmission is taking place at the time, the particular station can transmit.

15. 15 CSMA/CD If two stations attempt to transmit simultaneously, this causes a collision, which is detected by all participating stations. After a random time interval, the stations that collided attempt to transmit again. If another collision occurs, the time intervals from which the random waiting time is selected are increased step by step. This is known as exponential back off.

16. 16 ARP Cache Essential to the efficient operation of ARP is the maintenance of a cache on each host The cache maintains the recent IP to physical address mappings Each entry is aged (usually the life time is 20 min) forcing periodic updates of the cache ARP replies are often broadcast so that all hosts can update their caches

17. 17 Proxy ARP Proxy ARP lets a router answer ARP requests on one of its networks for a host on another of its networks This fools the sender of the ARP request in to thinking that the router is the destination The router is acting as proxy agent for the destination, relaying packets to it from other hosts

18. 18 Proxy ARP (Cont.) Proxy ARP is also known as promiscuous ARP or the ARP hack The names come from the other use of proxy ARP: to hide two physical networks form each other, with a router between the two This had been used to separate hosts running two different versions of TCP/IP

19. 19 Gratuitous ARP Gratuitous ARP occurs when a host sends an ARP request looking for its own IP address This can happen at bootstrap time Gratuitous ARP provides two features It lets a host determine if another host is already configured with the same IP address If the host sending the gratuitous ARP has just changed its hardware address, the packet causes other hosts on the net to update their ARP cache entries

20. 20 Security Issues ARP can be a dangerous protocol A bogus host can issue a gratuitous ARP and change cache entries A bogus host can send replies giving its own hardware address (instead of the target) Broadcasting can be expensive Excessive use of bandwidth CPU costs

21. 21 Reverse Address Resolution Protocol When a system boots, it typically gets its IP address from a file (network configuration file) How does a system without a disk, get its IP address? Since each system has an unique hardware address, that hardware address can be used to lookup the corresponding IP address RARP is used to find IP address with the MAC address (of the network card)

22. 22 RARP Packet Format The format is exactly the same as ARP except some of the numbers change The RARP request is broadcast and the reply is sent to the requester Unlike ARP, designated RARP server(s) that handles RARP requests

23. 23 ARP command The arp command shows the ARP table Flags: p=Publish; s=Static; m=Mapping To manipulate the system ’ s ARP cache arp –a [hostname] (view the arp cache) arp –s hostname HWaddress (add an entry) arp –f filename (add from file) arp –d hostname (delete entries)

24. 24 ARP command (Cont.) arp –a can be used to see the contents of the ARP cache # arp -a ? (192.168.19.77) at 00:08:02:85:FB:1C [ether] on eth0 ? (192.168.19.254) at 00:00:0C:07:AC:04 [ether] on eth0