ARP

May 2005
Barry Irwin
 What is it?
The address resolution protocol is needed
because IP addresses only make sense to
the TCP/IP protocol suite.

A data link, such as ethernet, has its own

addressing scheme to which any network
layer using the data link must conform.
 What it does
ARP provides a mapping between the two
different forms of addresses - 32 bit IP
addresses and whatever type of address the
data link uses.

It is dynamic, and happens automatically.

 Displaying ARP info
The ARP cache on a host may be displayed
using the Unix command

arp -a
 Proxy ARP
This lets a router answer ARP requests on
one network for a host on another of its
networks.
 Reverse ARP
When a system with a local disk is booted, it
normally obtains its IP address off a local
configuration file.

A diskless workstation cannot do this, and

needs to obtain an IP address for its
hardware address.
 More on ARP
9.603939 146.231.120.1 -> Broadcast ARP Who has 146.231.120.208? Tell 146.231.120.1
9.603963 146.231.120.1 -> Broadcast ARP Who has 146.231.126.138? Tell 146.231.120.1
9.603989 146.231.120.1 -> Broadcast ARP Who has 146.231.126.175? Tell 146.231.120.1
9.604292 146.231.120.1 -> Broadcast ARP Who has 146.231.120.161? Tell 146.231.120.1
9.604315 146.231.120.1 -> Broadcast ARP Who has 146.231.121.163? Tell 146.231.120.1
9.604391 146.231.120.1 -> Broadcast ARP Who has 146.231.127.130? Tell 146.231.120.1
9.604443 146.231.120.1 -> Broadcast ARP Who has 146.231.127.226? Tell 146.231.120.1
9.604467 146.231.120.1 -> Broadcast ARP Who has 146.231.125.63? Tell 146.231.120.1
9.604515 146.231.120.1 -> Broadcast ARP Who has 146.231.122.158? Tell 146.231.120.1
9.604539 146.231.120.1 -> Broadcast ARP Who has 146.231.126.250? Tell 146.231.120.1
9.604563 146.231.120.1 -> Broadcast ARP Who has 146.231.126.218? Tell 146.231.120.1
9.604587 146.231.120.1 -> Broadcast ARP Who has 146.231.120.91? Tell 146.231.120.1
9.604611 146.231.120.1 -> Broadcast ARP Who has 146.231.120.65? Tell 146.231.120.1
9.744634 146.231.123.99 -> Broadcast ARP Who has 146.231.120.65? Tell 146.231.123.99
9.947620 146.231.120.1 -> Broadcast ARP Who has 146.231.125.25? Tell 146.231.120.1
10.098980 146.231.120.100 -> Broadcast ARP Who has 146.231.122.1? Tell 146.231.120.100
10.718341 146.231.120.1 -> Broadcast ARP Who has 146.231.126.57? Tell 146.231.120.1
11.242490 146.231.123.99 -> Broadcast ARP Who has 146.231.120.65? Tell 146.231.123.99
11.419530 146.231.120.1 -> Broadcast ARP Who has 146.231.120.90? Tell 146.231.120.1
11.499811 146.231.120.1 -> Broadcast ARP Who has 146.231.126.90? Tell 146.231.120.1

• ARP Broadcasts
• Broadcast Storms
 The ARP Exchange
C:\Program Files\Ethereal>tethereal.exe arp
and host 146.231.122.34
1. 146.231.122.34 -> Broadcast ARP Who has
146.231.120.1? Tell 146.231.122.34
2. 146.231.120.1 -> 146.231.122.34 ARP
146.231.120.1 is at 00:04:dc:5c:1e:01
3. 146.231.122.34 -> Broadcast ARP Who has
146.231.123.15? Tell 146.231.122.34
4. 146.231.123.15 -> 146.231.122.34 ARP
146.231.123.15 is at 00:c0:df:08:39:80
The ARP Exchange
 The ARP Table
• Windows
D:\>-a
Interface: 146.231.122.34 --- 0x2
Internet Address Physical Address Type
146.231.120.1 00-04-dc-5c-1e-01 dynamic
146.231.120.68 00-02-b3-8f-d6-45 dynamic
146.231.120.71 00-02-b3-89-e0-11 dynamic
146.231.120.77 00-02-b3-88-2f-82 dynamic
146.231.123.15 00-c0-df-08-39-80 dynamic

• UNIX
$ arp -a
vlan120.nortel.ru.ac.za (146.231.120.1) at 00:04:dc:5c:1e:01 on rl0 [ethernet]
spiderman.ict.ru.ac.za (146.231.120.71) at 00:02:b3:89:e0:11 on rl0 [ethernet]
artoodetoo.ict.ru.ac.za (146.231.120.77) at 00:02:b3:88:2f:82 on rl0 [ethernet]
segv.ict.ru.ac.za (146.231.122.34) at 00:10:dc:cd:24:27 on rl0 [ethernet]
hons14.ict.ru.ac.za (146.231.123.78) at 00:10:dc:cd:25:01 on rl0 [ethernet]
hons19.ict.ru.ac.za (146.231.123.83) at 00:10:dc:cd:24:21 on rl0 [ethernet]
 Static vs. Dynamic ARP
• Dynamic Arp is how it should be used
• However there are circumstances where
static ARP is required
• Static ARP allows one to add static ( semi-
permanent) entries into a system’s arp table
hons15.ict.ru.ac.za (146.231.123.79) at 00:ca:fe:ba:be:84
on rl0 permanent [ethernet]
hons19.ict.ru.ac.za (146.231.123.83) at 00:de:ad:be:ef:01
on rl0 permanent [ethernet]
 Which leads to...
BOOTP or DHCP, the subject of the next set
of slides...