ARP - Address Resolution Protocol

Overview

Address Resolution Protocol (ARP) is a predominant protocol for finding a host's hardware address when only its network layer address is known. This protocol operates below the network layer as a part of the interface between the OSI network and OSI link layer. It is used when IPv4 is used over Ethernet.Before stepping into the nuances of it lets go through its Frame structure of this protocol.

ARP Frame Format and types

ARP Packet Format

Hardware type
Each data link layer protocol is assigned a number used in this field. For Ethernet it is 1.

Protocol type
Each protocol is assigned a number used in this field. For example, IPv4 is 0x0800.

Hardware length
Length in bytes of a hardware address. Ethernet addresses are 6 bytes long.

Protocol length
Length in bytes of a logical address. IPv4 addresses are 4 bytes long.

Operation
Specifies the operation the sender is performing: 1 for request, and 2 for reply.

There are actually four types of ARP messages that may be sent by the ARP protocol. These are identified by four values in the "operation" field of an ARP message. The types of message are:

1.ARP request
2.ARP reply
3.RARP request
4.RARP reply

Sender hardware address
Hardware address of the sender.


Sender protocol address
Protocol address of the sender.

Target hardware address
Hardware address of the intended receiver. This field is zero on request.

Target protocol address
Protocol address of the intended receiver.

ARP Function explained
ARP is used in four cases when two hosts are communicating:


1.When two hosts are on the same network and one desires to send a packet to the other
2.When two hosts are on the different networks and must use a gateway or router to reach the other host
3.When a router needs to forward a packet for one host through another router
4.When a router needs to forward a packet from one host to the destination host on the same network


When an ARP response arrives, the receiver inserts a binding into an ARP cache so that it can be used for further packets. The oldest entry is removed if the table is either full or after an entry has not been updated recently. When an ARP request arrives, the receiver checks if it has the senders protocol address in the cache; if so, then the receiver updates the cache entry with the sender's binding. After a host replies to an ARP request, it adds the sender's binding to the cache - if a message travels from one host to another, then a reply will often travel back.

To understand this further lets see how an ARP actually works:

ARP works by broadcasting the packet to all hosts attached to an Ethernet network. The packet contains the IP address the sender is interested in communicating with. The target machine, recognizing that the IP address in the packet matches its own, returns an answer. Hosts actually keep a cache of ARP responses

Lets take an example here to study this concept by ARP across subnet:


From the fig above lets say:


computer A needs to send some data to computer B


Since host B is not on the same subnet, before sending computer A transmits an ARP request in order to discover the MAC address of port A on the local router. This is done after the A checks its ARP cache and it does not find an entry for the MAC address of port A.

Once host A knows the MAC address, it transmits an Ethernet frame to the router.

This router C will send an ARP request out of port B in order to discover the MAC address of computer B.

Once Computer B replies to this ARP request, the router will strip off the Ethernet frame from the data and create a new one.

The router replaces the source MAC address (originally host A address) with the MAC address of port B. It will also replace the destination MAC address (originally port A) with the MAC address of host B.The fig 1 shows the Message format used.

The following fig shows the basic strategy and principle used by ARP:


ARP Cache concept

The ARP cache contains a table containing matched sets of MAC and IP addresses. Each device on the network manages its own ARP cache table. There are two ways in which ARP cache is populated:

Static ARP Cache Entries: In this type address resolutions are manually added to the cache table for a device and are kept in the cache on a permanent basis.

Dynamic ARP Cache Entries: These are hardware and IP address pairs that are added to the cache by the software itself as a result of successfully completed past ARP resolutions. They are kept in the cache only for a period of time and are then flushed. After a particular entry times out, it is removed from the cache. The next time that address mapping is needed a fresh resolution is performed to update the cache.

Note: A devices ARP cache can contain both static and dynamic entries.

Reverse ARP and Proxy ARP defined

Reverse Address Resolution Protocol (RARP) is a complement of the Address Resolution Protocol. It is a network layer protocol used to obtain an IP address for a given MAC address. The primary limitation of RARP is that each MAC address must be configured manually on a centralised server, and that the protocol only conveys an IP address. Its useful for diskless systems.

Proxy ARP a protocol that is used to hide a machine with a public IP on a private network behind a router, and still have the machine appear to be on the public network "in front of" the router. For this example, let's assume that host A is on a network segment connected to Router A's interface A, and host B is on a network segment connected to Router A's interface B. Host A wants to send data directly to host B, but doesn't have host B's MAC address. An ARP Request sent to host B from host A will stop at the router as it is a broadcast - but with Proxy ARP, the router A will actually answer the ARP Request with the MAC address of the router interface that received the ARP Request.

In this case, Router A will respond to the ARP Request with the MAC address of it's own interface A. This is transparent to the host A - when host A sends data to host B, the destination IP address will be that of host B, but the destination MAC address will be that of RouterA's A interface.

Though ARP is a simple resolution protocol its features and use with regards to network is immense.