Table Of Contents

ARP - Q&A

Questions

1. What is ARP?
2. To which OSI layer does ARP belong?
3. Which RFC specify the requirements for ARP?
4. What is the use of ARP?
5. Why a IP address needs to be mapped to a MAC address, why can't the MAC
address itself is represented using the IP address?
6. Can ARP be used in a network other than Ethernet?
7. How does ARP resolve an IP address to an Ethernet MAC address?
8. What is an ARP cache?
9. When is an ARP request packet generated?
10. What happens when a host receives an ARP request packet?
11. Will a host update its ARP cache upon receiving any ARP request?
12. What is the disadvantage if a host updates its ARP cache upon receiving any
ARP request?
13. What happens when a host receives an ARP reply packet?
14. Is there a separate packet format for ARP request and ARP reply?
15. Which MAC address is an ARP request directed to?
16. To which MAC address is an ARP reply packet directed to?
17. If a host is not able to get the MAC address of a host, how it knows about its IP
address?
18. What will happen if an ARP reply is not received for an ARP request?
19. When is an entry added to the ARP cache?
20. What will happen if a new ARP request packet is received, but the MAC address
to IP address is already present in the ARP cache?
21. When is an entry removed from an ARP cache?
22. What is the format of an ARP packet?
23. What is the size of an ARP request and reply packet?
24. How to differentiate between a ARP request packet and a ARP reply packet, as
the Ethernet type field is same on both the packets?
25. Why is the hardware MAC address present in both the Ethernet header and the
ARP packet (request and reply)?
26. What is proxy ARP?
27. What is the use of proxy ARP?
28. What is gratuitous ARP?
29. What is the use of gratuitous ARP?

Answers

1. What is ARP?
Address Resolution Protocol (ARP) is a network protocol, which maps a
network layer protocol address to a data link layer hardware address. For
 example, ARP is used to resolve IP address to the corresponding Ethernet
address.
2. To which OSI layer does ARP belong?
ARP belongs to the OSI data link layer (Layer 2). ARP protocol is implemented
by the network protocol driver. ARP packets are encapsulated by Ethernet
headers and transmitted.
3. Which RFC specify the requirements for ARP?
RFC 826 specifies the ARP packet format and other details.
4. What is the use of ARP?
A host in an Ethernet network can communicate with another host, only if it
knows the Ethernet address (MAC address) of that host. The higher level
protocols like IP use a different kind of addressing scheme (like IP address)
from the lower level hardware addressing scheme like MAC address. ARP is
used to get the Ethernet address of a host from its IP address. ARP is extensively
used by all the hosts in an Ethernet network.
5. Why a IP address needs to be mapped to a MAC address, why can't the
MAC address itself is represented using the IP address?
The length of a MAC address is 6 bytes and the length of an IP address is 4
bytes. Obviously, the MAC address cannot be represented using the IP address.
So an IP address must be mapped to the corresponding MAC address.
6. Can ARP be used in a network other than Ethernet?
ARP is a general protocol, which can be used in any type of broadcast network.
The fields in the ARP packet specifies the type of the MAC address and the type
of the protocol address. ARP is used with most IEEE 802.x LAN media. In
particular, it is also used with FDDI, Token Ring, and Fast Ethernet, in precisely
the same way as it is with Ethernet.
7. How does ARP resolve an IP address to an Ethernet MAC address?
When ARP needs to resolve a given IP address to Ethernet address, it broadcasts
an ARP request packet. The ARP request packet contains the source MAC
address and the source IP address and the destination IP address. Each host in
the local network receives this packet. The host with the specified destination IP
address, sends an ARP reply packet to the originating host with its IP address.
8. What is an ARP cache?
ARP maintains the mapping between IP address and MAC address in a table in
memory called ARP cache. The entries in this table are dynamically added and
removed.
9. When is an ARP request packet generated?
The following steps results in the generation of an ARP request packet:
1. The IP module sends a packet, destined for another host in the network,
to the ARP module.
2. The ARP module looks up the ARP table (cache) to resolve the IP
address.
3. If the supplied IP address is present in the ARP cache, it is resolved into
its Ethernet address.
4. If the ARP module is not able to find an entry for this IP address in the
ARP cache, then it sends an ARP request packet to the Ethernet driver, to
resolve the IP address to the Ethernet address.
5. After the IP address is resolved by the ARP module, the packet is sent to
the Ethernet driver for transmission.
10. What happens when a host receives an ARP request packet?
The ARP request is received and processed by all the hosts in the network, since
it is a broadcast packet. The following steps are carried out when a ARP request
packet is received by a host:
1. If the IP address to be resolved is for this host, then the ARP module
sends an ARP reply packet with its Ethernet MAC address.
2. If the IP address to be resolved is for this host, then the ARP module
updates its ARP cache with the source Ethernet MAC address to source
IP address mapping present in the ARP request packet. If the entry is
already present in the cache, it is overwritten. If it is not present, it is
added.
3. If the IP address to be resolved is not for this host, then the ARP module
discards the ARP request packet.
11. Will a host update its ARP cache upon receiving any ARP request?
A host will update its ARP cache, only if the ARP request is for its IP address.
Otherwise, it will discard the ARP request.
12. What is the disadvantage if a host updates its ARP cache upon receiving
any ARP request?
The host will exhaust the ARP cache with a lot of unused ARP entries, if it
updates the ARP cache for any ARP request.
13. What happens when a host receives an ARP reply packet?
The ARP reply packet is received only by the host, which transmitted the ARP
request packet. The ARP module adds the Ethernet hardware address to IP
address mapping present in the ARP reply packet to the ARP cache.
14. Is there a separate packet format for ARP request and ARP reply?
No. Both the ARP request and ARP reply packets use the same format.
15. Which MAC address is an ARP request directed to?
All ARP request packets are transmitted with the Ethernet broadcast address, so
that all hosts in the network will receive the request.
16. To which MAC address is an ARP reply packet directed to?
ARP reply packet is directed to the host, which transmitted the ARP request
packet.
17. If a host is not able to get the MAC address of a host, how it knows about its
IP address?
A host will either use a static file like /etc/hosts or DNS protocol to get the IP
address of another host.
18. What will happen if an ARP reply is not received for an ARP request?
If an ARP reply is not received, then that IP address cannot be resolved to an
Ethernet address. Without a Ethernet address, the packets cannot be transmitted.
19. When is an entry added to the ARP cache?
A new entry is added to the ARP cache when an IP address is successfully
mapped to a MAC address. Usually, entries are added dynamically to the ARP
cache. Static entries can also be added.
20. What will happen if a new ARP request packet is received, but the MAC
address to IP address is already present in the ARP cache?
If a ARP request packet is received and the mapping already exists in the ARP
cache, it will be overwritten with the values present in the request.
21. When is an entry removed from an ARP cache?
An entry in an ARP cache is removed after a pre-determined timeout period (e.g.
20 minutes).
22. What is the format of an ARP packet?
The various fields of a ARP request/reply packet and their length are shown
below:
23. +--------+
24. |Hardware| 2 bytes
25. |MAC |
26. |Address |
27. |Type |
28. +--------+
29. |Protocol| 2 bytes
30. |Address |
31. |Type |
32. +--------+
33. |Hardware| 1 byte
34. |MAC |
35. |Address |
36. |Size |
37. +--------+
38. |Protocol| 1 byte
39. |Address |
40. |Size |
41. +--------+
42. |Op | 2 bytes
43. +--------+
44. |Sender | 6 bytes (depends on the above size field)
45. |MAC |
46. |Address |
47. +--------+
48. |Sender | 4 bytes (depends on the above size field)
49. |IP |
50. |Address |
51. +--------+
52. |Target | 6 bytes (depends on the above size field)
53. |MAC |
54. |Address |
55. +--------+
56. |Target | 4 bytes (depends on the above size field)
57. |IP |
58. |Address |
59. +--------+

The fields are further explained below:

+---------
+-------------------------------------------------------+
|Ethernet |For a ARP request, source MAC address is the MAC
|
|Header |address of the host sending the ARP request,
|
| |destination MAC address is the Ethernet broadcast
|
| |address (FF:FF:FF:FF:FF:FF), frame type field is
0x806.|
| |For ARP reply, source MAC address is the MAC
address of|
| |the host replying to the ARP request, destination
MAC |
| |address is the MAC address of the host that sent
the |
 | |ARP request, and the frame type field is 0x806.
|
+---------
+-------------------------------------------------------+
|Hardware |Type of the hardware MAC address which is being
mapped.|
|Address |For Ethernet the value of this field is 1.
|
|Type |
|
+---------
+-------------------------------------------------------+
|Protocol |Type of the protocol address to which the MAC
address |
|Address |is mapped. For IP address the value of this
field is |
|Type |0x800.
|
+---------
+-------------------------------------------------------+
|Hardware |Size of the hardware MAC address. For Ethernet,
the |
|Address |value of this field is 6.
|
|Size |
|
+---------
+-------------------------------------------------------+
|Protocol |Size of the protocol address. For IP, the value
of |
|Address |this field is 4.
|
|Size |
|
+---------
+-------------------------------------------------------+
|Operation|Type of operation being performed. The value of
this |
| |field can be 1 (ARP request), 2 (ARP reply)
|
+---------
+-------------------------------------------------------+
|Source |The hardware MAC address of the host sending the
ARP |
|MAC |request or reply. This is same as the source MAC
|
|address |address present in the Ethernet header.
|
+---------
+-------------------------------------------------------+
|Source |The IP address of the host sending the ARP
request or |
|IP |reply.
|
|address |
|
+---------
+-------------------------------------------------------+
|Target |The hardware MAC address of the host receiving
the ARP |
 |MAC |request or reply. This is same as the
destination MAC |
|address |address present in the Ethernet header.
|
+---------
+-------------------------------------------------------+
|Target |The IP address of the host receiving the ARP
request |
|IP |or reply.
|
|address |
|
+---------
+-------------------------------------------------------+

60. What is the size of an ARP request and reply packet?

The size of an ARP request or reply packet is 28 bytes.
61. How to differentiate between a ARP request packet and a ARP reply
packet, as the Ethernet type field is same on both the packets?
An ARP request packet can be differentiated from an ARP reply packet using
the 'operation' field in the ARP packet. For a ARP request it is 1 and for an ARP
reply it is 2.
62. Why is the hardware MAC address present in both the Ethernet header
and the ARP packet (request and reply)?
The Ethernet header is processed by the data link driver and removed from the
packet. When the ARP layer gets the packet, it needs to know the hardware and
protocol addresses in order to update the table. That is why the hardware MAC
address is present in both the Ethernet header and the ARP packet.
63. What is proxy ARP?
Proxy ARP is the process in which one system responds to the ARP request for
another system. For example, host A sends an ARP request to resolve the IP
address of host B. Instead of Host B, Host C responds to this ARP request.
64. What is the use of proxy ARP?
When routers receive ARP requests from one network for hosts on the network,
they will respond with a ARP reply packet with their MAC address. For
example, let us say host A is in one network, host B is in another network and
router C connects these two networks. When host A sends an ARP request to
resolve the IP address of host B, the router C receives this packet. The router C
sends an ARP reply with its MAC address. So host A will send all the packets
destined for host B to the router C. Router C will then forward those packets to
host B. Proxy ARP is also used if a host in a network is not able to understand
subnet addressing. For example, if host A and host B are actually in two
different subnets, but host A cannot understand subnet addressing. So host A
assumes that host B is present in the same network. In this case a router, host C,
can use proxy ARP to route packets between host A and host B.
65. What is gratuitous ARP?
When a host sends an ARP request to resolve its own IP address, it is called
gratuitous ARP. In the ARP request packet, the source IP address and
destination IP address are filled with the same source IP address itself. The
destination MAC address is the Ethernet broadcast address
(FF:FF:FF:FF:FF:FF).
66. What is the use of gratuitous ARP?
Gratuitous ARP is used for the following:
 1. In a properly configured network, there will not be an ARP reply for a
gratuitous ARP request. But if another host in the network is also
configured with the same IP address as the source host, then the source
host will get an ARP reply. In this way, a host can determine whether
another host is also configured with its IP address.
2. When the network interface card in a system is changed, the MAC
address to its IP address mapping is changed. In this case, when the host
is rebooted, it will send an ARP request packet for its own IP address. As
this is a broadcast packet, all the hosts in the network will receive and
process this packet. They will update their old mapping in the ARP cache
with this new mapping.

Table Of Contents