Chapter 4 ARP: Address Resolution Protocol

Highlights ARP is used with IPv4 only; IPv6 uses the Neighbor Discovery Protocol, which is incorporated into ICMPv6 ARP is used to resolve an IP address RARP: Reverse ARP – Used for diskless systems – Rarely used today

Ethernet hosts in the same broadcast domain ARP queries are sent using link-layer broadcast frames that are received by all hosts. The single host with the assigned address responds directly to the requesting host. Non-IP hosts must actively discard ARP queries.

ARP Cache Linux% arp Address HWtype HWaddress Flags Mask Iface gw.home ether 00:0D:66:4F:60:00 C eth1 printer.home ether 00:0A:95:87:38:6A C eth1 Linux% arp -a printer.home ( ) at 00:0A:95:87:38:6A [ether] on eth1 gw.home ( ) at 00:0D:66:4F:60:00 [ether] on eth1

Flags M: manually entered C: learned by ARP P: Publish. Host responds to incoming ARP requests with an ARP response – Used for proxy ARP

ARP for mapping IPv4 to 48 bit MAC

Example C:\> arp -a Verify that the ARP cache is empty No ARP Entries Found C:\> telnet www Connect to the Web server [port 80] Connecting to Escape character is '^]'. Type Control + right bracket to get the Telnet client prompt. Welcome to Microsoft Telnet Client Escape Character is 'CTRL+]' Microsoft Telnet> quit

Example (contd.) Linux# tcpdump -e :0:c0:6f:2d:40 ff:ff:ff:ff:ff:ff arp 60: arp who-has tell (0.0022)0:0:c0:c2:9b:26 0:0:c0:6f:2d:40 arp 60: arp reply is-at 0:0:c0:c2:9b: (0.0007)0:0:c0:6f:2d:40 0:0:c0:c2:9b:26 ip 60: > www: S : (0) win 4096 [tos 0x10] (0.0050)0:0:c0:c2:9b:26 0:0:c0:6f:2d:40 ip 60: www > : S : (0) ack win (0.0018)0:0:c0:6f:2d:40 0:0:c0:c2:9b:26 ip 60: > discard:. ack 1 win 4096 [tos 0x10]

ARP to a non-existent host Linux% date ; telnet ; date Fri Jan 29 14:46:33 PST 2010 Trying telnet: connect to address : No route to host Fri Jan 29 14:46:36 PST s after previous date Linux% arp -a ? ( ) at on eth0 Linux# tcpdump –n arp 1 21:12: arp who-has tell :12: arp who-has tell :12: arp who-has tell

ARP Features ARP Cache Timeout – Typically 20 mins for completed entry – Typically 3 mins for an incomplete entry Proxy/Promiscuous ARP – Fools the sender into thinking that it is the destination

ARP Features ARP Cache Timeout – Typically 20 mins for compelted entry – Typically 3 mins for an incomplete entry Proxy/Promiscuous ARP – Fools the sender into thinking that it is the destination

Gratuitous ARP Send ARP request looking for own IP address Goals – To find out if another host is using same IP – Flush cache of others upon hardware interface change Linux# tcpdump -e -n arp :0:c0:6f:2d:40 ff:ff:ff:ff:ff:ff arp 60: arp who-has tell

IPv4 Address Conflict DetectionIPv4 Address Conflict Detection (ACD). Gratuitous ARP provides indication of duplicate use. ACD provides a way to address the issue ARP Probe: to find out if anyone is using my IP address – Like gratuitous ARP – But, Sender’s Protocol Address field to 0 – To avoid polluting caches in case it is in use ARP announcement: to tell other nodes that I am using this IP address – Like probe but Sender’s and Target’s protocol address are filled in with the IP address Operation – Sends 3 probes at random times at bootup – Sends 2 announcements to announce that it is taking the IP address