ISIT328 Corporate Network Security

ARP Address Resolution Protocol

23/02/y v2 1
Introduction
In this lecture we delve deeper into Networking Services:
ARP
DHCP

23/02/y v2 2
 Gateway

23/02/y v2 3
ARP - Address Resolution Protocol.

23/02/y v2 4
We all know now that the world of the computer is largely
focused on its LAN (vLAN)
Fundamental reality is that hardware addresses are
necessary for data transfer to occur.
ARP discovers the hardware address associated with a
specific IP address
ARP can only be used to find MAC addresses of devices
connected to the LAN

23/02/y v2 5
 1. If Host A wants to send a packet to Host B on the same
LAN using an IP address it uses ARP to discover Host B’s
MAC address.
2. If Host B is not on the same network the router
(gateway) will intervene to find out how Host B can be
reached. The router will supply is own hardware (MAC
address) for Host A’s ARP cache*.

*Every machine maintains an ARP cache which contains the results of

ARP requests.

23/02/y v2 6
The ARP request uses a broadcast message (“Does anyone know the
address 197.15.22.126?”).

Physical Address IP Address

02-60-8C-01-02-03 197.15.22.23
00-00-0A-05-09-89 197.15.22.44
?? 197.15.22.126

23/02/y v2 7
23/02/y v2 8
An ARP request packet is divided into:
– Frame header – which contains
o the host (source address)
o broadcast address (FF-FF-FF-FF-FF-FF)
– ARP Request

An Ethernet frame
ARP

Destination Source Data

Mac Address MAC Address Type CRC

6 bytes 6 bytes 2 bytes 46 -1500 4 bytes

bytes

23/02/y v2 9
The machine that has a NIC with this address responds with a Reply
“Yes, that’s the IP address assigned to me! Please find my physical
address in the Source address field”

(If devices do not recognise the IP address they will ignore the
request)

• The Source then updates its ARP table and can proceed to send
information to that destination.

23/02/y v2 10
Physical Address IP Address
02-60-8C-01-02-03 197.15.22.23
00-00-0A-05-09-89 197.15.22.44
00-B6-07-06-03-81 197.15.22.126

Relevant commands from command line

arp –a :displays ARP table

arp –d * : deletes entries to ARP table

23/02/y v2 11
Related terms for you to research on wikipedia.

Gratuitous ARP – advanced warning given to ARP tables before the

device requesting this

Reverse ARP – see DHCP (Dynamic Host Control Protocol)

END

23/02/y v2 12