9.7 Address Resolution Protocol (arp)

9.7.1 The arp Process - Mapping ip to mac Addresses Page 1:

The ARP protocol provides two basic functions:

• Resolving IPv4 addresses to MAC addresses

• Maintaining a cache of mappings

Resolving IPv4 Addresses to MAC Addresses

For a frame to be placed on the LAN media, it must have a destination MAC address. When a packet is sent to the Data Link layer to be encapsulated into a frame, the node refers to a table in its memory to find the Data Link layer address that is mapped to the destination IPv4 address. This table is called the ARP table or the ARP cache. The ARP table is stored in the RAM of the device.

Each entry, or row, of the ARP table has a pair of values: an IP Address and a MAC address. We call the relationship between the two values a map - it simply means that you can locate an IP address in the table and discover the corresponding MAC address. The ARP table caches the mapping for the devices on the local LAN.

To begin the process, a transmitting node attempts to locate in the ARP table the MAC address mapped to an IPv4 destination. If this map is cached in the table, the node uses the MAC address as the destination MAC in the frame that encapsulates the IPv4 packet. The frame is then encoded onto the networking media.

Maintaining the ARP Table

The ARP table is maintained dynamically. There are two ways that a device can gather MAC addresses. One way is to monitor the traffic that occurs on the local network segment. As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs.

Another way a device can get an address pair is to broadcast an ARP request. ARP sends a Layer 2 broadcast to all devices on the Ethernet LAN. The frame contains an ARP request packet with the IP address of the destination host. The node receiving the frame that identifies the IP address as its own responds by sending an ARP reply packet back to the sender as a unicast frame. This response is then used to make a new entry in the ARP table.

These dynamic entries in the ARP table are timestamped in much the same way that MAC table entries are timestamped in switches. If a device does not receive a frame from a particular device by the time the timestamp expires, the entry for this device is removed from the ARP table.

Additionally, static map entries can be entered in an ARP table, but this is rarely done. Static ARP table entries do not expire over time and must be manually removed.

Creating the Frame

What does a node do when it needs to create a frame and the ARP cache does not contain a map of an IP address to a destination MAC address? When ARP receives a request to map an IPv4 address to a MAC address, it looks for the cached map in its ARP table. If an entry is not found, the encapsulation of the IPv4 packet fails and the Layer 2 processes notify ARP that it needs a map.

The ARP processes then send out an ARP request packet to discover the MAC address of the destination device on the local network. If a device receiving the request has the destination IP address, it responds with an ARP reply. A map is created in the ARP table. Packets for that IPv4 address can now be encapsulated in frames.

If no device responds to the ARP request, the packet is dropped because a frame cannot be created. This encapsulation failure is reported to the upper layers of the device. If the device is an intermediary device, like a router, the upper layers may choose to respond to the source host with an error in an ICMPv4 packet.

Click the step numbers in the figure to see the process used to get the MAC address of node on the local physical network.

In the lab, you will use Wireshark to observe ARP requests and responses across a network.

9.7.1 - The ARP Process - Mapping IP to MAC Addresses The diagram depicts the Address Resolution Protocol (ARP) process used for mapping IP and MAC addresses for hosts on the local network. Follow the steps for generating a new pair of addresses in the ARP table when the destination is on the local network.  Step 1: Four PC's are shown. PC's A, B, C, and D and a router are attached to common shared media. PC A wants to send a frame to PC C. These PC's have the following IP and MAC addresses:  PC A IP address: 10.10.0.1, MAC address: 00-0d-88-c7-9a-24  PC C IP address: 10.10.0.3, MAC address: 00-0d-56-09-fb-d1  Step 2: No ARP entry. PC A says: I need to send a frame to 10.10.0.3, but I don't know the MAC address.  Step 3: Broadcast ARP request to devices. PC A says: If your IP address is 10.10.0.3, please tell 10.10.0.1 (00-0d-88-c7-9a-24).  Step 4: Unicast ARP reply with MAC address. PC C says: I am 10.10.0.3. My MAC address is 00-0d-56-09-fb-d1.  Step 5: IP and MAC addresses for PC D are stored in ARP cache. PC A says: I will store 10.10.0.3 and 00-0d-56-09-fb-d1 in my ARP cache.  Step 6: ARP entry enables frame to be sent. PC A says: I can now send the frame to 10.10.0.3 with the MAC address 00-0d-56-09-fb-d1.