ARP

ARP is the process that a source host uses to determine the destination MAC address. Although the destination MAC address can be a unicast, broadcast, or multicast address, the source MAC address must always be a unicast.

Every device with an IP address on a network also has an Ethernet MAC address. When a device sends an Ethernet frame, it contains these two addresses:

• Destination MAC address 


• Source MAC address 

To resolve the destination MAC address ARP provides two basic functions:

• Resolving IPv4 addresses to MAC addresses

• Maintain a table of mappings

ARP Functions

Resolving IPv4 Addresses to MAC Addresses

Data link layer of the OSI model encapsulates the incoming packet into in Ethernet frame. Encapsulation process refers to an ARP table in its memory to find the MAC address that mapped to the IPv4 address.ARP table is also called ARP cache. The ARP table is stored in the RAM. Each sending device search its ARP table for a destination IPv4 address and its and a related MAC address

• If the destination IPv4 address is on the same network as the source IPv4 address, the device will look the ARP table for the destination IPv4 address.

• If the destination IPv4 address is not on the same network to the source IPv4 address, the device will look the ARP table for the IPv4 address of the default gateway.

Each entry of the ARP table binds MAC address with an IPv4 address. The relationship between IPv4 and MAC address is called a map. By the help of a map, we can locate an IPv4 address in the table and find out the corresponding MAC address. The ARP table saves the mapping temporarily. If the device received a frame and its find that there is no entry for the corresponding MAC address, then the device sends an ARP request.

ARP request messages are encapsulated directly within an Ethernet frame. There is no IPv4 header. The ARP request message includes following:

• Target IPv4 address –The IPv4 address of the destination device.

• Target MAC address - Unknown MAC address and this will be empty in the ARP request message.

The ARP request is encapsulated in an Ethernet frame with the following header information:

• Destination MAC address – This is a broadcast address requiring all Ethernet NICs on the LAN to accept and process the ARP request.

• Source MAC address – This is the MAC address of the ARP request sender.

• Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.

ARP requests are a broadcast process, so it's flooded out to all ports by the switch except the receiving port. The device on the LAN which IPv4 address matches the target IPv4 address in the ARP request will reply. All other devices will discard the ARP request packet.

If the destination IPv4 address is not on the same network as the source IPv4 address, the source device needs to send the frame to its default gateway. This is the interface of the router. The device will encapsulate that packet in a frame using the destination MAC address of the local router.

The default gateway IPv4 address is stored in the IPv4 configuration of the hosts. When a host creates a packet for a destination, it compares the destination IPv4 address and its own IPv4 address to determine if the two IP addresses are located on the same network. If the destination host is not on its same network, the source checks its ARP table for an entry with the IPv4 address of the default gateway. If there is not an entry, it uses the ARP process to determine a MAC address of the default gateway.

Removing Entries from an ARP Table

ARP cache saves the entries for a specified period of the time. The times different depending on the device’s operating system.

Commands may also be used to manually remove all or some of the entries in the ARP table. After an entry has been removed, the process for sending an ARP request and receiving an ARP reply must occur again to enter the map in the ARP table.

ARP Tables

On a Cisco router, the show ip arp command is used to display the ARP table.

On a Windows, the arp –a command is used to display the ARP table.