Address Resolution Protocol

Address Resolution Protocol (ARP) is a mechanism used by IP to find the hardware address of a host from an IP address.

When IP is trying to send a datagram to the Data Link Layer (layer 2), Ethernet will be informed to look for the hardware address, also known as MAC Address, of the destination in the local network. Since Ethernet is using hardware addresses to identify source and destination, ARP will be used to obtain the hardware address by broadcast the specified IP address. Then, the machine that matched the specified IP address will reply with the requested hardware address.

Figure 9: ARP broadcast

ARP Packet Format

Similar to IP Packet, Each ARP packet field is explain as follows:

Figure 10: ARP packet

The image below is a snapshot of an ARP packet capture on Ethereal:

Figure 11: ARP packet captured from Ethereal

Notice the destination from Ethernet header is all 1s (ff:ff:ff:ff:ff:ff). ARP is performing a broadcast in the above trace.

Here is another example for ARP to locate hardware address. “arp –a” command allows to display current ARP cache tables for all interfaces:

Figure 12: ARP Command for Hardware Address

IP allows datagram to transport across a large network, the Internet. However, if two nodes are going to communicate across the same Local Area Network (LAN), IP in layer 3 will not be needed because ARP with the Ethernet address is enough for the data transfer. Unless many different layer 2 communications are established across the internet, then IP and router will be forced to use. Layer 3 IP is usually only used when a communication goes beyond layer 2 and is required.

Summary

Address Resolution Protocol (ARP) is a mechanism used by IP that finds the hardware address of a host from an IP address within the local area network.