---

The Address Resolution Protocol (ARP)

---

• Review: IP packet forwarding
  • Recall that:

    An IP packet must be transmitted in a frame that contain the physical address of the IP node Graphically:

    Question:

    How can a node find the physical address for the (logical) IP address ??? The router does not store the physical address of the IP nodes in its forwarding/routing tables !!!

  ---

  ---

  ---

  ---

• Address Resolution
  • "Address Resolution" :

    Address resolution = find the physical (real) address that corresponds to a logical (IP) address

  ---

  ---

  ---

  ---

• Data structure used to resolve IP addresses to Physical addresses
  • The mapping information for a logical (IP) address to physical address is stored in:

    The Address Resolution Protocol Cache (ARP cache)

    Example: (ARP cache)

    Logical (IP) address | Physical (Ethernet) address ------------------------+-------------------------------- 170.140.150.186 | 00:13:72:a3:17:e7 170.140.150.128 | 00:03:ba:2f:d0:21 .... | .....

    ---

    ---

  • UNIX command to display the content of the ARP cache:

    arp -n

    Example:

    cheung@aruba> arp -n (IP) Address HWtype HWaddress Flags Mask Iface ========================================================================== 170.140.151.110 ether 3c:d9:2b:76:d9:16 C eth0 170.140.151.7 ether 00:14:4f:1f:cc:ca C eth0 170.140.150.253 ether 00:16:36:e0:7e:a4 C eth0 170.140.150.8 ether 00:03:ba:08:d1:a4 C eth0 170.140.151.20 ether 00:1e:68:2f:71:ae C eth0 170.140.150.9 ether 02:08:20:6b:a8:9e C eth0 170.140.150.2 ether 00:03:ba:13:8f:e1 C eth0 170.140.150.1 ether 00:03:ba:72:e3:4d C eth0 170.140.150.60 ether 00:14:4f:a8:31:08 C eth0 170.140.150.254 ether 00:00:0c:9f:f0:00 C eth0

  • The address in red is an Ethernet Address

  ---

  ---

  ---

  ---

• Maintaining the ARP cache
  • Fact:

    The ARP cache is filled/maintained by using: The Address Resolution Protocol (ARP)

    ---

    ---

  • Important fact:

    The ARP protocol requires the use of: The broadcast search capability of the to physical network

  ---

  ---

  ---

  ---

  ---

  ---

• ARP: finding the Physical (Ethernet) address for an IP address
  • Purpose of the ARP protocol:

    Find the physical address that corresponds to a given logical IP address

  • The ARP protocol:

    The sender: Sends a broadcast Ethernet frame containing a ARP-request message (as frame type The broadcast Ethernet frame contains the broadcast destination address (which is all 1-bits) The ARP-request message body contains the IP address Example: node B wants to find the physical (Ethernet) address of the IP address y9 Note: the Ethernet frame uses the broadcast address 111111....1 All hosts on the network will receive the ARP request (because the frame has the broadcast address): Each host (computer) will than match the requested IP address against its own IP address The node whose IP address matches the requested IP-address will reply with an ARP-response message The ARP response contains the physical (Ethernet) address !!! Example: (The ARP response is carried in the data portion of the Ethernet frame)

  ---

  ---

  ---

  ---

• The ARP Cache: minimize the usage of the ARP protocol
  • Fact:

    An ARP request is very intrusive (= disturb many nodes) because it is transmitted using broadcast: All nodes in the network will receive and must process the ARP message

    ---

    ---

  • Reducing the number of ARP requests:

    The information returned by the ARP protocol is saved: in the ARP cache          The ARP protocol is only invoked when: The IP address can not be found (= resolved) using the ARP cache information

  ---

  ---

  ---

  ---

• Security Problems with ARP
  • Fact:

    The ARP protocol has some major security risks...

  • But this topic (security) is beyond the scope of this course...

    ---

  • If you want to explore some spoofing techniques, read this excellent article: click here

    (I have a local copy: click here )