Address Resolution Protocol

Address Resolution Protocol (ARP) is one of the major protocol in the TCP/IP suite and
the purpose of Address Resolution Protocol (ARP) is to resolve an IPv4 address (32 bit
Logical Address) to the physical address (48 bit MAC Address). Network Applications at
the Application Layer use IPv4 Address to communicate with another device. But at the
Datalink layer, the addressing is MAC address (48 bit Physical Address), and this
address is burned into the network card permanently. You can view your network card’s
hardware address by typing the command "ipconfig /all" at the command prompt
(Without double quotes using Windows Operating Systems).

The purpose of Address Resolution Protocol (ARP) is to find out the MAC address of a
device in your Local Area Network (LAN), for the corresponding IPv4 address, which
network application is trying to communicate.

Address Resolution Protocol (ARP) Message Format

Address Resolution Protocol (ARP) Message Format

Following are the fields in the Address Resolution Protocol (ARP) Message Format.

Hardware Type: Hardware Type field in the Address Resolution Protocol (ARP)
Message specifies the type of hardware used for the local network transmitting the
Address Resolution Protocol (ARP) message. Ethernet is the common Hardware Type
and he value for Ethernet is 1. The size of this field is 2 bytes.

Protocol Type: Each protocol is assigned a number used in this field. IPv4 is 2048
(0x0800 in Hexa).

Hardware Address Length: Hardware Address Length in the Address Resolution

Protocol (ARP) Message is length in bytes of a hardware (MAC) address. Ethernet MAC
addresses are 6 bytes long.

Protocol Address Length: Length in bytes of a logical address (IPv4 Address). IPv4
addresses are 4 bytes long.

Opcode: Opcode field in the Address Resolution Protocol (ARP) Message specifies the
nature of the ARP message. 1 for ARP request and 2 for ARP reply.

Sender Hardware Address: Layer 2 (MAC Address) address of the device sending the
message.

Sender Protocol Address: The protocol address (IPv4 address) of the device sending
the message

Target Hardware Address: Layer 2 (MAC Address) of the intended receiver. This field
is ignored in requests.

Target Protocol Address: The protocol address (IPv4 Address) of the intended
receiver.

Working of Address Resolution Protocol (ARP)

Step 1: When a source device want to communicate with another device, source device
checks its Address Resolution Protocol (ARP) cache to find it already has a
resolved MAC Address of the destination device. If it is there, it will use that MAC
Address for communication. To view your Local Address Resolution Protocol (ARP)
cache, Open Command Prompt and type command "arp -a" (Without double quotes
using Windows Operating Systems).

Step 2: If ARP resolution is not there in local cache, the source machine will generate
an Address Resolution Protocol (ARP) request message, it puts its own data link layer
address as the Sender Hardware Address and its own IPv4 Address as the Sender
Protocol Address. It fills the destination IPv4 Address as the Target Protocol Address.
The Target Hardware Address will be left blank, since the machine is trying to find that.

Step 3: The source broadcast the Address Resolution Protocol (ARP) request message
to the local network.
Step 4: The message is received by each device on the LAN since it is a broadcast.
Each device compare the Target Protocol Address (IPv4 Address of the machine to
which the source is trying to communicate) with its own Protocol Address (IPv4
Address). Those who do not match will drop the packet without any action.

Step 5: When the targeted device checks the Target Protocol Address, it will find a
match and will generate an Address Resolution Protocol (ARP) reply message. It takes
the Sender Hardware Address and the Sender Protocol Address fields from the Address
Resolution Protocol (ARP) request message and uses these values for the Targeted
Hardware Address and Targeted Protocol Address of the reply message.

Step 6: The destination device will update its Address Resolution Protocol (ARP) cache,
since it need to contact the sender machine soon.

Step 7: Destination device send the Address Resolution Protocol (ARP) reply message
and it will NOT be a broadcast, but a unicast.

Step 8: The source machine will process the Address Resolution Protocol (ARP) reply
from destination, it store the Sender Hardware Address as the layer 2 address of the
destination.

Step 9: The source machine will update its Address Resolution Protocol (ARP) cache
with the Sender Hardware Address and Sender Protocol Address it received from the
Address Resolution Protocol (ARP) reply message.

Address Resolution Protocol Explained with an example

Let us take an example of below topology.

I am sitting at 192.168.0.84. I want to ping to 192.168.0.122, to check the network
connectivity. While issuing ping command, we never specify the MAC Address of the
destination device (192.168.0.122).
We know that ping command works using ICMP. ICMP is encapsulated inside IP
datagram and IP datagram is encapsulated within Ethernet Frame. We need Source IP
Address (my IP Address, 192.168.0.84), Destination IP Address (192.168.0.122),
Source MAC Address (my MAC Address 08:00:27:58:58:98) and Destination MAC
Address to make the Ethernet Frame for ICMP message. Source IP Address,
Destination IP Address, Source MAC Address are known at this instance, but the
Destination MAC Address unknown at this instance.

To assemble the Ethernet Frame, my device must have the Destination MAC
Address corresponding to the IP Address 192.168.0.122.

We need to resolve the Destination MAC Address corresponding to the IP Address

192.168.0.122.

Step 1: Before resolving the Destination MAC Address corresponding to the IP

Address 192.168.0.122, using Address Resolution Protocol (ARP), source device
checks its Address Resolution Protocol (ARP) cache to find it already has a
resolved MAC Address of the destination device. We can view the ARP cache by using
the command arp -a

The ARP cache in my computer is empty. There are no entries in my ARP cache.
Step 2: Now my computer need to resolve the destination MAC address using ARP. My
computer will prepare an ARP Request message and send it with a Destination MAC
Address as FF:FF:FF:FF:FF:FF (Broadcast MAC Address) to LAN Switch.
Step 3: Since the Destination MAC Address is FF:FF:FF:FF:FF:FF (Broadcast MAC
Address), the LAN Switch will flood it to all the connected ports and every device in the
LAN will get a copy of it.

Following screen shot shows the Wireshark capture window of ARP Request message.
You must compare the below screen shot with ARP message format image at the
beginning of this lesson. We can see from the below screen shot that the
Destination MAC Address is FF:FF:FF:FF:FF:FF (Broadcast MAC Address), ARP
opcode is 1 (for ARP Request), and the Target MAC Address is 00:00:00:00:00:00,
which is unknown at this instance.

We can also see from the below screen shot that the Source IP Address is
192.168.0.84, Destination IP Address is 192.168.0.122, Source MAC
Address 08:00:27:58:58:98 and Destination MAC Address is 00:00:00:00:00:00.
Step 4: The ARP Request message is received by each device on the LAN since it is
a broadcast. Each device compare the Target Protocol Address (192.168.0.122), with
its own IP Address. Those who do not match will drop the packet without any action.

Step 5: When the computer with the IP Address 192.168.0.122 receives the ARP
Request, it must prepare an ARP Reply and send back to the computer who sent the
ARP Request. ARP Reply will be a unicast, to save Network Resources.
Note that the ARP Reply has the Opcodef filled as 2, which is used to identify it as a
ARP Reply.

The "Sender MAC Address" field (which is marked below) in ARP Reply is the
answer for ARP Request.
Now both the computers can update their ARP cache, so that the MAC Address to IP
Address mappings can be used for a future communication. However, after a small
period of time, ARP cache is flushed to avoid incorrect mappings (IP Address of any
device can change at any time)

The ARP cache filled with a MAC address to IP Address mapping is shown below.
You have learned Address Resolution Protocol (ARP), Address Resolution Protocol
(ARP) Message Format and how Address Resolution Protocol (ARP) operate in a LAN.