Notes by mraabo

Address Resolution Protocol (ARP)

Protocol used to map IP addresses to MAC-Addresses on Local Area Networks (LANs).

Used each time a device needs to communicate with another device on the local network.

Essential for data transmission on Ethernet networks.

Functionality

ARP operates through a simple request-response mechanism:

  1. Need for Resolution: When Device A wants to communicate with Device B on the same network, it knows B’s IP address but needs its MAC address.

  2. ARP Request: Device A creates an ARP request packet containing:

    • Sender’s MAC and IP addresses
    • Target IP address
    • Broadcast MAC address (FF:FF:FF:FF:FF:FF) as the destination

  3. Broadcasting: The request is broadcast to all devices on the local network segment.

  4. Processing by Recipients: Each device examines the target IP in the request:

    • If it doesn’t match their IP, they discard the packet
    • If it matches, they proceed to step 5

  5. ARP Reply: Device B (with matching IP) creates an ARP reply containing:

    • Its own MAC address
    • Its IP address
    • Device A’s MAC and IP as the destination

  6. Unicast Response: Unlike the request, the reply is sent directly to Device A’s MAC address.

  7. Caching: Device A receives the reply, extracts Device B’s MAC address, and:

    • Stores the IP-to-MAC mapping in its ARP cache
    • Uses this mapping for subsequent communications
    • The cache entry typically expires after a timeout period (often 2-20 minutes)

  8. Data Transmission: Now Device A can create Frames with Device B’s MAC-Address and send data.

ARP (Address Resolution Protocol) is primarily considered a Link Layer (Layer 2) Protocol because it directly handles MAC addresses and operates only within local network segments.

However, it has characteristics that bridge layers since it translates between IP addresses (Layer 3) and MAC-Address (Layer 2), leading some to informally call it a “Layer 2.5” protocol.

In the OSI model, ARP is classified as a link layer protocol that provides essential services to the network layer, enabling IP-based communication over Ethernet networks. Most networking implementations place ARP modules within network interface drivers, confirming its fundamental role at the link layer despite its close interaction with network layer components.

Security

Vulnerable to ARP spoofing/poisoning attacks where attackers send fake ARP messages.

Graph View

Backlinks