Address Resolution Protocol (ARP)

When sending data end-to-end through a network, routers are used in internetworking to create a virtual network from one device to another, either locally or globally. Routers are configured to operate with most common network protocols. That means they know the format of the addresses, how many bytes are in the basic package of data sent out over the network, and how to make sure all the packages reach their destination and get reassembled. For the routers that are part of the Internet's main "backbone," this means looking at and forwarding millions of information packages every second.

As I discussed in my last blog, for end-to-end packet delivery addressing is done at two different layers of the OSI model. These two different layers use different types of addresses for different purposes. Layer 2 addresses, such as IEEE 802 MAC (Media Access Control) addresses, are used for local transmissions between hardware devices that can communicate directly. They are used to implement basic LAN, WLAN, and WAN technologies. In contrast, Layer 3 addresses, which are most commonly 32-bit Internet Protocol (IP) addresses, are used in internetworking to create a virtual network at the network layer.

The odds are very good that you will never see the MAC addresses for any of your equipment, because the software that helps your devices communicate with a network takes care of matching a Layer 2 MAC address to a Layer 3 logical address. In computer and device networking, the Address Resolution Protocol (ARP) is the method for finding a host's link layer (hardware) address when only its Internet Layer L-3 Internet Protocol (IP) address is known. ARP is defined in RFC 826.

ARP has been implemented in many types of networks since it is not an IP-only or Ethernet-only protocol. It can be used to resolve many different network layer protocol addresses to interface hardware addresses, although, due to the overwhelming prevalence of Ipv4 and Ethernet, ARP is primarily used to translate IP addresses to Ethernet MAC addresses. ARP is also used for IP over other LAN technologies, such as Token Ring, FDDI, and IP over ATM.

ARP is a Data Link Layer protocol because it only operates on the local area network or point-to-point link that a host is connected to. The purpose of ARP is to resolve addresses by finding the MAC address that corresponds to an IP address. Even though a sending system may know the IP address it wants to ultimately send data to, it may not know the MAC address. On an Ethernet LAN, systems communicate directly using CSMA/CD and must know the MAC address of the system that data is being be sent to next.

Remember that MAC addresses are fixed. Ethernet network adapters, or Network Interface Cards (NIC), are produced with a physical address embedded in the hardware. Manufacturers take care to ensure that these 6-byte (48-bit) addresses are unique, and Ethernet relies on these unique identifiers for message delivery.

IP addresses, on the other hand, are not fixed on any interface. Systems can be manually configured with an IP address, or they can obtain one using the Dynamic Host Configuration Protocol (DHCP). As such, it doesn’t make much sense to have a static mapping between the two, since IP addresses may change. Instead, when a system needs to obtain the MAC address associated with an IP address, it sends out a Layer 2 broadcast message asking that the system with the specified IP address reply with its MAC address. Once it receives a reply, the answer is cached for a limited period of time (typically between 2 and 20 minutes) in the system’s ARP table.

Since an ARP request is a Layer 2 broadcast, it will be seen by every system in the same broadcast domain. When any system receives an ARP request, it will check to see if it is the intended recipient. If it is, the system will process the Ethernet frame. If not, the Ethernet frame is ignored. Caching helps to ensure that ARP broadcasts don’t continually flood a network.

Author: David Stahl