- 29 Eki 2018
- 2,698
- 565
What is Address Resolution Protocol (ARP)?
Address Resolution Protocol (ARP) is a procedure for mapping a dynamic IP address to a permanent physical machine address in a LAN. The physical machine address is also known as a MAC address.
The job of ARP is essentially to translate 32-bit addresses to 48-bit addresses and vice versa. This is necessary because IP addresses in IPv4 are 32 bits, but MAC addresses are 48 bits.
ARP works between Layers 2 and 3 of the Open Systems Interconnection model. The MAC address exists on Layer 2 of the Open Systems Interconnection model, the data link layer. The IP address exists on Layer 3, the network layer.
ARP can also be used for IP over other LAN technologies, such as token ring, fiber distributed data interface and IP over ATM.
How ARP works
When a new computer joins a LAN, it is assigned a unique IP address to use for identification and communication. When an incoming packet destined for a host machine on a particular LAN arrives at a gateway, the gateway asks the ARP program to find a MAC address that matches the IP address. A table called the ARP cache maintains a record of each IP address and its corresponding MAC address.
All operating systems in an IPv4 Ethernet network keep an ARP cache. Every time a host requests a MAC address in order to send a packet to another host in the LAN, it checks its ARP cache to see if the IP to MAC address translation already exists. If it does, then a new ARP request is unnecessary. If the translation does not already exist, then the request for network addresses is sent and ARP is performed.
ARP broadcasts a request packet to all the machines on the LAN and asks if any of the machines are using that particular IP address. When a machine recognizes the IP address as its own, it sends a reply so ARP can update the cache for future reference and proceed with the communication.
Host machines that don't know their own IP address can use the Reverse ARP protocol for discovery.
ARP cache size is limited and is periodically cleansed of all entries to free up space. Addresses tend to stay in the cache for only a few minutes. Frequent updates enable other devices in the network to see when a physical host changes their requested IP addresses. In the cleaning process, unused entries are deleted along with any unsuccessful attempts to communicate with computers that are not currently powered on.
Proxy ARP
Proxy ARP enables a network proxy to answer ARP queries for IP addresses that are outside the network. This enables packets to be successfully transferred from one subnetwork to another.
When an ARP inquiry packet is broadcast, the routing table is examined to find which device on the LAN can reach the destination fastest. This device, which is often a router, acts as a gateway for forwarding packets outside the network to their intended destinations.
ARP spoofing and ARP cache poisoning
LANs that use ARP are vulnerable to ARP spoofing, also called ARP poison routing or ARP cache poisoning.
ARP spoofing is a device attack in which a hacker broadcasts false ARP messages over a LAN in order to link an attacker's MAC address with the IP address of a legitimate computer or server within the network. Once a link has been established, the target computer can send frames meant for the original destination to the hacker's computer first as well as any data meant for the legitimate IP address.
ARP spoofing can seriously affect enterprises. When used in their simplest form, ARP spoofing attacks can steal sensitive information. However, the attacks can also facilitate other malicious attacks, including the following:
- man-in-the-middle attacks
- denial-of-service attacks
- session hijacking
History and future of ARP
ARP was first proposed and discussed in Request for Comments (RFC) 826, published in November of 1982 by David C. Plummer. The problem of address resolution was immediately evident in the early days of the IP suite, because Ethernet quickly became the preferred LAN technology, but Ethernet cables required 48-bit addresses.
IPv6 addresses, which are 128 bits, use the Neighbor Discovery protocol acquire configuration information instead of ARP. While IPv4 addresses are currently more common, the use of IPv6 is increasing. This increase is largely due to the influx of IoT devices that require IP addresses. Neighbor Discovery operates in the Layer 2 of the Open Systems Interconnection model and uses Internet Control Message Protocol version 6 to discover neighboring nodes.
IPv6 addresses, which are 128 bits, use the Neighbor Discovery protocol acquire configuration information instead of ARP. While IPv4 addresses are currently more common, the use of IPv6 is increasing. This increase is largely due to the influx of IoT devices that require IP addresses. Neighbor Discovery operates in the Layer 2 of the Open Systems Interconnection model and uses Internet Control Message Protocol version 6 to discover neighboring nodes.
