ARP

Every device on an Ethernet/IP network has two addresses the MAC address at the Ethernet layer and the IP address at the network layer. To communicate with a device over Ethernet, you need to know the devices MAC address. However, because you are running IP on top of the Ethernet layer, you need to be able to address other devices using their IP address, not their MAC address. The Address Resolution Protocol (ARP) allows us to do this. Besides IP, ARP is the only Ethernet payload I discuss in this chapter. (There are others, but they are beyond the scope of this discussion.) The ARP packet format looks like this

Hardware	2 bytes
Protocol	2 bytes
Hlen	1 byte
Plen	1 byte
Operation	2 bytes
Sender Hardware Address	6 bytes
Sender IP Address	4 bytes
Target Hardware Address	6 bytes
Target IP Address	4 bytes

Notice that ARP does not have a payload, so there is no further encapsulation. The only purpose of ARP is to resolve the MAC/IP address combination. Every device on a network must support the ability to receive an incoming ARP request and respond to that request if appropriate.

ARP resolves what would appear to be a catch-22. The device that wants to communicate with the target must ask the target what its MAC address is, but, to do so, it must already know the address of the target! This dilemma is resolved by broadcasting the ARP request to all devices on the subnet using a special broadcast Ethernet address (FF:FF:FF:FF:FF:FF).

All devices on a network must be able to receive an Ethernet broadcast. Part of the message broadcast is the fact that the message is of type ARP . The incoming ARP request contains the IP address of the device for which the requester is trying to get the MAC address (the target IP address). The ARP packet handler for each device that receives the broadcasted request must compare this IP address to its own IP address. If there is a match, the device sends an ARP response to the requester using the hardware (MAC) and IP addresses taken from the incoming packet.

Once this information is retrieved by the requester, it is saved in the requesters local memory for some period of time. (This local storage is called an ARP cache .) Storing the MAC address allows the device to retrieve the MAC address for the given IP address later without having to issue another ARP request. The low-level drivers of a network stack protocol are constantly peeking at the incoming packets and storing away fresh MAC/IP combinations in the ARP cache. If the entry in the cache is not used for some period (could be anywhere from 2 to 20 minutes), the entry is removed (or flushed) from the cache.