Module 24: Address

Resolution
Networking Essentials 3.0
Module Objectives
Module Title: Address Resolution
Module Objective: Explain how ARP enables communication on a local area network.

Topic Title Topic Objective

ARP Describes the purpose of ARP.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2
24.1 ARP

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3
ARP
ARP Overview
• If your network uses the IPv4 communications protocol, you need ARP to map IPv4 addresses to MAC
addresses.

• Every IP device on an Ethernet network has a unique Ethernet MAC address.

• When a device sends an Ethernet Layer 2 frame, it contains these two addresses:
• The destination MAC address is the Ethernet MAC address of the destination device on the
same local network segment. If the destination host is on another network, then the destination
address in the frame would be that of the default gateway (i.e., router).
• The Source MAC address is the MAC address of the Ethernet NIC on the source host.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4
ARP
ARP Overview (Cont.)
• To send a packet to another host on the same local IPv4 network, a host must know the IPv4 address
and the MAC address of the destination device.

• Device destination IPv4 addresses are either known or resolved by device name, but MAC addresses
must be discovered.

• A device uses ARP to determine the destination MAC address of a local device when it knows its IPv4
address, and ARP provides two primary functions:
• Resolving IPv4 addresses to MAC addresses
• Maintaining a table of IPv4 to MAC address mappings

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5
ARP
ARP Functions
• When a packet is sent to the data link layer to encapsulate into an Ethernet frame, the device refers
to a table in its memory to find the MAC address mapped to the IPv4 address.

• This table is stored temporarily in RAM memory and called the ARP table or the ARP cache.

• The sending device will search its ARP table for a destination IPv4 address and a corresponding
MAC address:
• If the packet’s destination IPv4 address is on the same network as the source IPv4 address,
the device will search the ARP table for the destination IPv4 address.
• If the destination IPv4 address is on a different network than the source IPv4 address, the
device will search the ARP table for the IPv4 address of the default gateway.

• In both cases, the search is for an IPv4 address and a corresponding MAC address for the device.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6
ARP
ARP Functions (Cont.)
• Each entry, or row, of the ARP table, binds an IPv4 address with a MAC address.

• We call the relationship between the two values a map.

• This means you can locate an IPv4 address in the table and discover the corresponding MAC
address.

• The ARP table temporarily saves (caches) the mapping for the devices on the LAN.

• If the device locates the IPv4 address, it uses its corresponding MAC address as the destination
MAC address in the frame.

• The device sends an ARP request if it does not find an entry.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7
ARP
Video - ARP Operation - ARP Request
• When a device needs to determine the MAC address associated with an IPv4 address, it sends an ARP
request and does not have an entry for the IPv4 address in its ARP table.
• ARP messages are encapsulated directly within an Ethernet frame with no IPv4 header.
• The ARP request is encapsulated in an Ethernet frame using the following header information:
• Destination MAC address – is a broadcast address FF-FF-FF-FF-FF-FF requiring all Ethernet
NICs on the LAN to accept and process the ARP request.
• Source MAC address – The MAC address of the sender of the ARP request.
• Type - ARP messages have a type field of 0x806.
• ARP requests are broadcasts, which are flooded out of all ports by the switch (except the receiving
port).
• All Ethernet NICs on the LAN process broadcast and must deliver the ARP request to its operating
system for processing.
• Every device must process the ARP request to see if the target IPv4 address matches its own.
• Only one device on the LAN will have an IPv4 address that matches the target IPv4 address in the ARP
request, so all other devices will not reply.
• This video will cover an ARP request for a MAC address.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8
ARP
Video - ARP Operation - ARP Reply

• Only the device with the target IPv4 address associated with the ARP request will respond with an
ARP reply.
• The ARP reply is encapsulated in an Ethernet frame using the following header information:
• Destination MAC address – The MAC address of the sender of the ARP request.
• Source MAC address – The MAC address of the sender of the ARP reply.
• Type - ARP messages have a type field of 0x806.
• Only the device that originally sent the ARP request will receive the unicast ARP reply, and it will add
the IPv4 address and the corresponding MAC address to its ARP table.
• Packets destined for that IPv4 address can now be encapsulated in frames using its corresponding
MAC address.
• It drops the packet if no device responds to the ARP request because a frame cannot be created.
• Entries in the ARP table have a time stamp, so if a device does not receive a frame from a particular
device before the time stamp expires, the ARP table removes the entry for this device.
• Additionally, static map entries can be entered in an ARP table (rarely done), but they do not expire
over time and must manually remove.
• This video will cover an ARP reply in response to an ARP request.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9
ARP
Video - ARP Role in Remote Communications
• When the destination IPv4 address is not on the same network as the source IPv4 address, the
source device needs to send the frame to its default gateway (the local router's interface).
• Whenever a source device has a packet with an IPv4 address on another network, it will
encapsulate that packet in a frame using the destination MAC address of the router.
• The IPv4 configuration of the hosts stores the IPv4 address of the default gateway.
• When a host creates a packet for a destination, it compares the destination IPv4 address and its
IPv4 address to determine if the location of the two IPv4 addresses is on the same Layer 3
network.
• If the destination host is not on its same network, the source checks its ARP table for an entry with
the IPv4 address of the default gateway.
• If there is no entry, it uses the ARP process to determine the MAC address of the default gateway.
• This video will cover how an ARP request will provide a host with the MAC address of the default
gateway.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10
ARP
Removing Entries from an ARP Table
• For each device not using ARPs for a specified period, an ARP cache timer removes it.

• The times differ depending on the operating system of the device.

• For example, newer Windows operating systems store ARP table entries between 15 and 45
seconds, as illustrated in the figure.

• Using commands may also manually remove

some or all entries in the ARP table.

• After removing an entry, the process for sending

an ARP request and receiving an ARP reply must
occur again to enter the map in the ARP table.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11
ARP
ARP Tables on Devices

• The show ip arp command is used on a Cisco router to display the ARP table, as shown in the
figure.

• The arp- a command on a Windows 10 PC

is used to display the ARP table, as shown
in the figure.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12
ARP
ARP Issues - ARP Broadcasts and ARP Spoofing

• As a broadcast frame, every device on the local network

receives and processes an ARP request.

• On a typical business network, these broadcasts would

have minimal impact on network performance.

• Suppose several devices were to be powered up and all

start accessing network services simultaneously. In that
case, there could be some reduction in performance for a
short period, as shown in the figure.

• After the devices send out the initial ARP broadcasts and
have learned the necessary MAC addresses, any impact
on the network will be minimized.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13
ARP
ARP Issues - ARP Broadcasts and ARP Spoofing (Cont.)

• In some cases, using ARP can lead to a potential security risk.

• A threat actor can use ARP spoofing to perform an ARP
poisoning attack.
• It is a technique used by a threat actor to reply to an ARP
request for an IPv4 address that belongs to another device,
such as the default gateway, as shown in the figure.
• The threat actor sends an ARP reply with its own MAC
address.
• The receiver of the ARP reply will add the wrong MAC address
to its ARP table and send these packets to the threat actor.
• Enterprise-level switches include mitigation techniques known
as dynamic ARP inspection (DAI).

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14
ARP
Packet Tracer - Examine the ARP Table
In this Packet Tracer activity, you will complete the following objectives:

• Examine an ARP Request

• Examine a Switch MAC Address Table
• Examine the ARP Process in Remote Communications

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15
ARP
Lab - View ARP Traffic in Wireshark
In this activity, you will complete the following objectives:

• Part 1: Capture and Analyze ARP Data in Wireshark

• Part 2: View the ARP cache entries on the PC

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16
24.2 Address Resolution
Summary

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17
Address Resolution Summary
What Did I Learn in this Module?
• To send a packet to another host on the same local IPv4 network, a host must know the IPv4 address and
the MAC address of the destination device.
• A device uses ARP to determine the destination MAC address of a local device when it knows its IPv4
address.
• ARP provides two essential functions: resolving IPv4 addresses to MAC addresses and maintaining a table
of IPv4 to MAC address mappings.
• The sending device will search its ARP table for a destination IPv4 address and a corresponding MAC
address.
• If the packet’s destination IPv4 address is on the same network as the source IPv4 address, the device will
search the ARP table for the destination IPv4 address.
• If not, the device will search the ARP table for the IPv4 address of the default gateway.
• Each entry, or row, of the ARP table, binds an IPv4 address with a MAC address.
• The ARP request is encapsulated in an Ethernet frame using the following header information: destination
MAC address (broadcast address FF-FF-FF-FF-FF-FF), source MAC address (MAC address of the sender
of the ARP request), and type (0x806).
• ARP requests are broadcasts, which are flooded out of all ports by the switch (except the receiving port).
• Only the device with the target IPv4 address associated with the ARP request will respond with an ARP
reply.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18
Address Resolution Summary
What Did I Learn in this Module? (Cont.)
• After receiving the ARP reply, the device will add the IPv4 address and the corresponding MAC address to
its ARP table.
• When the destination IPv4 address is not on the same network as the source IPv4 address, the source
device needs to send the frame to its default gateway (the local router's interface).
• Whenever a source device has a packet with an IPv4 address on another network, it will encapsulate that
packet in a frame using the destination MAC address of the router.
• The IPv4 configuration of the hosts stores the IPv4 address of the default gateway.
• If the destination host is not on its same network, the source checks its ARP table for an entry with the IPv4
address of the default gateway.
• If there is no entry, it uses the ARP process to determine the MAC address of the default gateway.
• For each device, an ARP cache timer removes ARP entries not using a device for a specified period.
• The show ip arp command is used on a Cisco router to display the ARP table.
• The arp- a command on a Windows 10 PC is used to display the ARP table.
• As a broadcast frame, every device on the local network receives and processes an ARP request.
• In some cases, using ARP can lead to a potential security risk because a threat actor can use ARP
spoofing to perform an ARP poisoning attack.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19