ARP

ADDRESS RESOLUTION PROTOCOL


- ARP is a telecommunications protocol used for resolution of network layer addresses
  into link layer addresses.
- ARP resolves L3 addresses to L2 addresses. For example, ARP on Ethernet provides
  mapping between 32 bit IP addresses and 48 bit MAC addresses.
- It  is  a request  and reply protocol,  which  communicates within  the boundaries of a
  single network, never routed across internetwork nodes.
- ARP  is  a  low level  protocol and  it  is usually  handled  at the device driver level.



ARP PACKET FORMAT:
ARP uses a simple message format that contains one address resolution request or response.
The packet format is as follows:

Internet Protocol (IPv4) to Ethernet conversion
bit offset	0 – 7								8 – 15
0	Hardware type
16	Protocol type
32	Hardware address length								Protocol address length
48	Operation
64	Sender hardware address (first 16 bits)
80	(next 16 bits)
96	(last 16 bits)
112	Sender protocol address (first 16 bits)
128	(last 16 bits)
144	Target hardware address (first 16 bits)
160	(next 16 bits)
176	(last 16 bits)
192	Target protocol address (first 16 bits)
208	(last 16 bits)

FIELDS:

Hardware type: specifies the network protocol type. Eg: Ethernet is 1

Protocol type: the internetwork protocol for which the ARP request is intended. Eg: IPv4 is 0x0800

Hardware length: length in octets, of a hardware address. Eg: Eth addresses size is 6

Protocol length: length in octets, of addresses used in upper layer protocol. Eg: IPv4 address size is 4

Operation: operation that the sender is performing: 1 for request, 2 for reply.

Sender hardware address: media address of the sender

Sender protocol address: internetwork address of the sender

Target hardware address: media address of the intended receiver (field is ignored in requests)

Target protocol address: internetwork address of the intended receiver.

SO HOW DOES ARP WORK?
- Each device has an ARP cache, which contains a mapping of L3 addresses to L2 addresses.
- When a device wants to send data to a target device (to it's IP address), it first has to find the
   MAC address of the device.
- If the IP address does not appear in the sending device's ARP cache, then the initiating device
   first sends an ARP-request message on the local subnet.
- All ARP-REQUESTs are sent on the Ethernet Broadcast address.
- Since it is a broadcast, it is received by all the devices on the LAN.
- Every device checks if the given IP address belongs to itself:
  - If NO, then the host discards the packet. However, IF AND ONLY IF an entry exits for the 
    sender's IP address in this host's ARP cache, the entry is updated with the latest MAC address.
    If there is no entry for this sender IP address, then the ARP cache on this host is not touched.
  - If YES, then the host sends an ARP-reply in response to the broadcast, with it's own MAC
    address information in the reply packet.
- When an ARP-request is answered, both the sender of the ARP-reply and the original ARP
   request-er, record each other's IP address and MAC address as an entry in their respective
   ARP caches for future reference.

- If no ARP-reply is received for an ARP-request, then it means that no data can be sent to that

  IP address.

- Entries from an ARP cache are removed after a pre-determined timeout.

PROXY ARP:

When routers receive ARP-requests from one network for hosts which are on another network, they will respond with a ARP-reply packet with their MAC address. 

Eg: 

- Host A is in one network, host B is in another network and router C connects these two networks. 

- When host A sends an ARP-request to resolve the IP address of host B, the router C receives this packet. - The router C sends an ARP-reply with its MAC address. 

- Host A will now send all the packets destined for host B to the router C. 

- Router C will then forward those packets to host B. 

GRATUITOUS ARP:

When a host sends an ARP-request to resolve its own IP address, it is called Gratuitous ARP. In the ARP-request packet, the source IP address and destination IP address are filled with the same source IP address itself.  

Gratuitous ARP is used in the following cases:

- Detecting IP address conflict:

  Ideally, there should not be an ARP reply for a gratuitous ARP-request. 

  But if there is another host in the network with the same IP address as

  the source host, then the source host will get an ARP reply. This way a

  host can determine if there is another host on the network with its IP 

  address.

  Also, any host that receives an ARP-request with it's own IP address in

  the source field will know that there is an IP  address conflict.

- Updating ARP caches with new information:

  When the NIC card in a device is changed, it's MAC address to IP address

  mapping is changed. When the host is rebooted, it will send an ARP request

  packet for its own IP address. As this is a broadcast packet, all the 

  hosts in the network will receive and process this packet. They will 

  update their old mapping in the ARP cache with this new mapping.