On this page & study actions

Assessed progress

Learning resources

ARP Request and Reply Journey

Practice this topic Next topicInternet Control Message Protocol (ICMP)

Unit 4: Network Layer3 min read

Address Resolution Protocol (ARP)

The Address Resolution Protocol (ARP) serves as the critical bridge between the logical, network-layer addressing scheme and the physical, data-link-layer addressing scheme. Without a mechanism to map dynamic logical IP addresses to fixed physical media access control (MAC) addresses, local hardware interfaces could not encapsulate and deliver network-layer packets.

1. Address Mapping Overview

In any computer network utilizing the TCP/IP protocol suite, the delivery of packets to a host or a router relies on two distinct levels of addressing: logical addressing (IP addresses) and physical addressing (MAC addresses).

Logical Addresses: Globally unique virtual addresses used by the IP protocol at the network layer to route packets end-to-end across interconnected networks.
Physical Addresses: Localized hardware addresses utilized by the network interface cards (NICs) at the data link layer to transmit frames over a single, physical network medium (such as Ethernet or Wi-Fi).

To send an IP datagram, a host or a router must encapsulate it into a physical frame. Consequently, the sending device must map the destination's logical address into its corresponding physical address.

text

+-------------------+                      +-------------------+
|  Logical Address  |  ======= ARP ======> |  Physical Address |
|  (e.g., IPv4 IP)  |                      |    (e.g., MAC)    |
+-------------------+                      +-------------------+

Static vs. Dynamic Mapping

This translation can be implemented in two ways:

Static Mapping: Creating a fixed lookup table that associates each logical address with a physical address. This is highly inefficient in modern networks because physical NICs change, systems are reconfigured, and IP addresses are dynamically assigned via DHCP.
Dynamic Mapping: Using a protocol to resolve addresses on demand. ARP is the standard protocol that dynamically resolves a logical IP address into its physical MAC address.

2. ARP Protocol Architecture

ARP operates on the boundary between the network layer (Layer 3) and the data link layer (Layer 2). While it is technically classified as a network-layer helper protocol, it works directly with the data link layer to prepare packets for physical transmission.

text

       TCP/IP Protocol Suite Layering:
       +-----------------------------------------+
       |           Network Layer (IP)            |
       +--------------------+--------------------+
                            |
                     +------+------+
                     |     ARP     |
                     +------+------+
                            |
       +--------------------+--------------------+
       |             Data Link Layer             |
       +-----------------------------------------+

When an IP datagram is ready to be sent:

The IP protocol passes the packet and the target's logical address to the ARP software module.
ARP checks its local memory cache (ARP Cache) to determine if the physical address is already known.
If the physical address is not cached, ARP generates an ARP Request packet, encapsulates it, and sends it out over the physical network interface.

3. ARP Packet Structure

The standard ARP packet format is highly structured and designed to accommodate various network-layer and link-layer protocols. The typical packet size is $28$ bytes when resolving an IPv4 address to a standard Ethernet MAC address.

text

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Hardware Type         |         Protocol Type         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  HW Addr Len  |  Proto Addr   |          Operation            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Sender MAC                           |
|                               +-------------------------------+
|                               |          Sender IP            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Target MAC                           |
|                               +-------------------------------+
|                               |          Target IP            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Field Descriptions

Hardware Type (16 bits): Specifies the type of physical network. For Ethernet, this value is $1$ ( $0\text{x}0001$ ).
Protocol Type (16 bits): Specifies the network-layer protocol. For IPv4, this value is $0\text{x}0800$ .
Hardware Address Length (8 bits): The length of the physical address in bytes. For an Ethernet MAC address, this is $6$ bytes.
Protocol Address Length (8 bits): The length of the logical address in bytes. For IPv4, this is $4$ bytes.
Operation (16 bits): Indicates the message type.
- $1$ = ARP Request

4. Encapsulation and Ethernet Frame Alignment

To transmit an ARP packet over the physical medium, it must be encapsulated directly within a link-layer frame (such as an Ethernet II frame).

text

+------------------+------------------+---------------+-------------+-----+
| Destination MAC  |    Source MAC    |   EtherType   | ARP Payload | CRC |
|    (6 bytes)     |    (6 bytes)     |   (2 bytes)   | (28 bytes)  | (4) |
+------------------+------------------+---------------+-------------+-----+
                                              |
                                     Value: 0x0806

EtherType Identification: The link-layer frame designates its payload as an ARP packet by populating the EtherType field with the hexadecimal value $0\text{x}0806$ .
Frame Sizing and Padding: An Ethernet frame payload has a strict minimum size requirement of $46$ bytes. Because a standard IPv4-over-Ethernet ARP packet is only $28$ bytes, the network interface card must append $18$ bytes of padding (zeroes) to fulfill the minimum Ethernet frame length requirement.

5. ARP Operational Workflow (Request vs. Reply)

When a host needs to resolve a MAC address, it executes a precise, step-by-step query-response cycle.

text

Host A (192.168.1.10)                                 Host B (192.168.1.20)
       |                                                     |
       |--- Broadcast ARP Request -------------------------->|
       |    "Who has 192.168.1.20? Tell 192.168.1.10"        |
       |    (Dest MAC: FF:FF:FF:FF:FF:FF)                     |
       |                                                     |
       |<-- Unicast ARP Reply -------------------------------|
       |    "I have 192.168.1.20, my MAC is B"               |
       |    (Dest MAC: Host A's MAC)                         |
       |                                                     |

Step 1: Cache Lookup

The source host searches its internal lookup cache to see if it already has a valid mapping for the target IP. If a match is found, the MAC address is used immediately to frame the packet.

Step 2: Formulate and Broadcast the Request

If a cache miss occurs, the source constructs an ARP Request packet:

The Target Hardware Address (THA) is set to $00:00:00:00:00:00$ .
The packet is encapsulated within an Ethernet frame with a Destination MAC of the physical broadcast address: $\text{FF:FF:FF:FF:FF:FF}$
All hosts on the local physical network segment receive and process this broadcast frame.

Step 3: Receiver Processing

Every host on the local segment receives the frame, strips the Ethernet header, and inspects the ARP payload.

Non-Target Hosts: If a host's IP address does not match the Target Protocol Address (TPA), it discards the packet without taking action.
The Target Host: If a host detects that its assigned IP matches the TPA, it does two things:
1. It updates its own local ARP cache with the IP-to-MAC mapping of the sender (as extracted from the request's SPA and SHA fields). This optimizes future communications.
2. It constructs an ARP Reply packet.

Step 4: Unicast the Reply

The target host sets the Operation field of the reply packet to $2$ , populates its own physical address in the Sender Hardware Address (SHA) field, and places the original requester's physical address in the Target Hardware Address (THA) field.

The frame is encapsulated with the original requester's MAC address as the Destination MAC and sent as a targeted unicast frame.

6. The Four Fundamental Use Cases of ARP

ARP is utilized in four distinct network scenarios, determined by whether the sender and receiver are hosts or routers, and whether they reside on the same network segment.

text

                        +--------------+
                        |  Internet/   |
                        |  WAN Router  |
                        +-------+------+
                                |
             ===================+=================== Local Gateway (Router R1)
                                |
                   +------------+------------+
                   |                         |
               +---+----+                +---+----+
               | Host A |                | Host B |
               +--------+                +--------+

Case 1: Host to Host on the Same Local Network

Condition: Host $A$ wants to transmit a packet to Host $B$ on the same physical link.
ARP Operation: Host $A$ broadcasts an ARP request querying the physical MAC address of Host $B$ 's IP address directly.

Case 2: Host to Host on a Remote Network

Condition: Host $A$ wants to transmit a packet to a remote Host $C$ located across a WAN or routing interface.
ARP Operation: Host $A$ determines that Host $C$ is on a foreign subnet. Host $A$ routes the packet through its default gateway router ( $R_1$ ).

Case 3: Router to Host on the Same Local Network

Condition: Router $R_1$ receives an inbound packet destined for Host $B$ on one of its directly connected local networks.
ARP Operation: Router $R_1$ broadcasts an ARP request querying the physical MAC address of Host $B$ 's IP address.

Case 4: Router to Router

Condition: Router $R_1$ needs to route an IP packet to a next-hop router ( $R_2$ ) over a shared physical transit network.
ARP Operation: Router $R_1$ broadcasts an ARP request querying the physical MAC address of Router 's ingress interface IP address.

7. Proxy ARP and Cache Management

Several operational mechanisms are required to ensure ARP scales efficiently and reliably across larger networks.

ARP Caching and Timeout

To minimize broadcast traffic, every network device maintains an ARP Cache.

Dynamic Entries: Created automatically through standard ARP exchanges. To prevent stale mappings, these entries are removed after a configured timeout period (typically between $2$ to $20$ minutes).
Static Entries: Configured manually by a network administrator. These entries do not expire and remain in the ARP table until manually removed.

Proxy ARP

Proxy ARP is a technique where a router responds to an ARP request on behalf of a target host that is not on the same physical network segment.

text

                  Local Broadcast Domain           Remote Subnet
               +---------------------------+    +------------------+
               |  Host A === ARP Request ==>    |      Host B      |
               |             (For Host B)  |    |  (192.168.2.50)  |
               |                           |    |                  |
               |       [Router R1]         |    |                  |
               |      (Proxy Reply) <==============================|
               +---------------------------+    +------------------+

When Host $A$ broadcasts an ARP request for Host $B$ , Router $R_1$ intercepts the broadcast.
If Router $R_1$ has a valid route to reach Host $B$ , it responds to Host with its physical MAC address.

Summary

Mapping Necessity: ARP dynamically translates logical IP addresses ( $32$ bits in IPv4) into physical hardware MAC addresses ( $48$ bits in Ethernet) to allow frame transmission across physical links.
Asymmetrical Operation: ARP Requests are broadcasted to discover unknown hosts, whereas ARP Replies are targeted unicast messages.
Encapsulation: ARP packets are encapsulated directly inside Ethernet frames, using the EtherType field value $0\text{x}0806$ .
Scoping Boundaries: ARP operates exclusively within a single physical broadcast domain. To reach remote subnets, hosts must use ARP to resolve the physical MAC address of their local gateway router.

Assessed progress

Learning resources

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP)

1. Address Mapping Overview

Static vs. Dynamic Mapping

2. ARP Protocol Architecture

3. ARP Packet Structure

Field Descriptions

4. Encapsulation and Ethernet Frame Alignment

5. ARP Operational Workflow (Request vs. Reply)

Step 1: Cache Lookup

Step 2: Formulate and Broadcast the Request

Step 3: Receiver Processing

Step 4: Unicast the Reply

6. The Four Fundamental Use Cases of ARP

Case 1: Host to Host on the Same Local Network

Case 2: Host to Host on a Remote Network

Case 3: Router to Host on the Same Local Network

Case 4: Router to Router

7. Proxy ARP and Cache Management

ARP Caching and Timeout

Proxy ARP

Summary

Key Concepts

Address Mapping

ARP Request

ARP Reply

ARP Cache

Proxy ARP

Quick Check

Computer Networks

Computer Networks