Skip to content
Search

Address Resolution Protocol

lastmod 2023-08-12created 2014-07-1019 edits

The Address Resolution Protocol (ARP) is a protocol used to map IP addresses to physical network addresses on a network. Here, a physical network address means the 48-bit network card address of Ethernet or Token Ring.

For example, when IP host A wants to send an IP packet to IP host B but does not know B's physical network address, it uses the ARP protocol to send onto the network an ARP packet with destination IP address B and the broadcast physical network address FFFFFFFFFFFF. When IP host B receives an ARP packet whose destination is its own IP address, it replies to A with its physical network address.

The IP addresses and corresponding physical network addresses collected this way are stored as a table in memory called the ARP cache on each IP host, and are reused when sending packets. In contrast to ARP, when an IP host knows its own physical network address but not its IP address, it uses RARP to request an IP address from a server.

Because there is no way to verify who sent ARP information, if a user on the same network sends forged information, users who receive it will send packets to the wrong MAC address. An attack that exploits this is ARP spoofing.

ARP header fields (ARP Header)

  • Hardware Type (HTYPE): defines the network type; set to 0x0001 for Ethernet
  • Protocol Type (PTYPE): defines the protocol; set to 0x0800 for IP version 4 (IPv4)
  • Hardware Length (HLEN): defines the length of the MAC address; set to 6 bytes for Ethernet
  • Protocol Length (PLEN): defines the length of the protocol address; set to 4 bytes for IPv4
  • Operation (OPER): the packet type; set to 1 for an ARP request (ARP Request) and 2 for an ARP reply (ARP Reply)
  • Sender Hardware Address (SHA): set to the sender's MAC address
  • Sender Protocol Address (SPA): set to the sender's IP address
  • Target Hardware Address (THA): the destination MAC address, which is unknown in an ARP Request
  • Target Protocol Address (TPA): set to the destination IP address

ARP broadcast (ARP Broadcast)

When communicating with another system on the same segment, communication uses MAC addresses rather than protocol addresses (IP). Whether hosts are on the same network is determined by the subnet mask (Subnet Mask) assigned along with the IP address.

ARP Cache Table

Security issues

Because there is no way to verify who sent ARP information, if a user on the same network sends forged information, users who receive it will send packets to the wrong MAC address. An attack that exploits this is ARP spoofing.

arp command

Flags

-v
Prints the ARP status.
-t type
Searches for the given type in the ARP cache. Types include ether (Enternet) and ax25 (AX25 packet radio); ether is the default type.
-a [host]
Shows the entry for the specified host among the registered hosts. If no host is specified, all registered hosts are printed.
-d [host]
Deletes the specified host from the list.
-s host hardware-address
Adds the host's hardware address, i.e., the host's MAC address. For Ethernet cards, it consists of 6 hexadecimal digits.
-f file
Adds the entries listed in a file.

Cache table 

arp -a

The output looks like this: 

Net to Media Table: IPv4
Device   IP Address               Mask      Flags   Phys Addr
------ -------------------- --------------- ----- ---------------
dmfe0  router.mynet.org     255.255.255.255       00:06:2a:77:4f:0d
dmfe0  server1.mynet.org    255.255.255.255       00:03:ba:24:de:11
dmfe0  myself               255.255.255.255 SP    00:03:ba:91:03:18

In this display, the following flags have been used:

  • S == static
  • P == publish (i.e., explicitly added by an arp -s command)

See also

Favorite site

References

  1. Naver_d2_-_Implementing_ARP_anti-spoofing_mechanisms_in_a_cloud_environment.pdf ↩

author Zer0 sitemap