Luminis Logo Luminis

English French German Italian Portuguese Russian Spanish

How Does Address Resolution Protocol (ARP) Work? - A Demonstration

Everyone who is in the networking field, knows about Address Resolution Protocol (ARP).

In the beginning of my IT career, when I started to study the networking, I struggled to understand and remember the definition of ARP.   I had some questions frequently arising in my mind, e.g.,

  • What is ARP exactly?
  • How does it work?
  • How to test it's working?
  • What is the easy way to remember it?

Here I take this opportunity to present you a good explanation of ARP and how it works.

What is ARP?

Address Resolution Protocol (ARP) is a protocol used by the Internet Protocol (IP) [RFC826], specifically IPv4, to map IP network addresses to the hardware addresses (MAC Address) used by a data link protocol.

This definition of ARP has 2-main aspects:

  1. Used by Internet Protocol (IP)
  2. To map IP network address (IP Address) to hardware address (MAC Address)

We will explore these two main aspects of ARP  with the help of following topology which consists of 1-Hub and 3-PCs. 

Step 1

Design the topology in the Cisco Packet Tracer, assign the IP addresses to PCs and noted down the MAC addresses as shown in the below-given figure: 

ARP ICMP topology

IP Address and MAC Address

Step 2

Check the ARP table of PC-1, PC-2, and PC-3 with the help of arp –a command on the ‘Command Prompt’. If you find any entry in it, then use the command arp –d to clear the entry or entries of ARP table. 

ARP Table

Step 3

In this step, we will ping the PC-1 from PC-3. On the PC-3 open the ‘Traffic Generator’. 

Fill the following information in the Traffic Generator:

  • Destination IP Address: 192.168.1.1
  • Source IP Address:192.168.1.3
  • Sequence Number: 1 and then click on ‘Send’

Traffic Generator will send the traffic (ping) to the destination.

Traffic Generator

From Step-4 to Step-10, we will observe that --how the ARP is working actually.

Step 4

To observe the traffic closely, select the ‘Simulation Mode’ and in the Simulation Panel click on ‘Capture/Forward’ button.

Simulation Panel

Observe the main window of Packet Tracer and the Event List of Simulation Panel.

ARP Packet and ICMP Packet

 Two types of packets will appear on PC-3:

  • ARP Packet
  • ICMP (ping) Packet

We intended to generate ping traffic only.  Right!  BUT why does ARP Packet come along with it.....??.....???

This is because, before sending the ICMP packets to the destination (PC-1 here) on the LAN, the MAC address of the destination device, should be in the ARP table of the source device (PC-3 here).

As we know the ARP table of the PC-3 is empty, that's why ARP will first collect the MAC address of the destination device, only then the ICMP will be able to send its traffic to destination device.

Let us click on the blue square in Simulation Panel, which is representing ICMP. It will open PDU Information box.

In the PDU information at Device PC-3, you can see how the PDUs are traversing between the OSI Layers.

Simulation Panel

It clearly shows--what is happening at 'Out Layer 3' of PC-3:

  1. The Ping process starts the next ping request.
  2. The Ping process creates an ICMP Echo Request message and sends it to the lower process.
  3. The device sets TTL in the packet header.
  4. The destination IP address is in the same subnet. The device sets the next-hop to destination.

PDU

At Out Layer 2:

  1. The next-hop IP address is a unicast. The ARP process looks it up in the ARP table.
  2. The next-hop IP address is not in the ARP table. The ARP process tries to send an ARP request for that IP address and buffers this packet.
  3. The ARP process constructs a request for the target IP address.
  4. The device encapsulates the PDU into an Ethernet frame.

Out Layer 1:

  1. FastEthernet0 sends out the frame.

Featured Article


Step 5

Now we will click on 'Capture/Forward' button to send ARP traffic from PC-3 to Hub-1.

 ARP Packet sent

When the Hub will receive the ARP frame, it actually stops here.  In order to broadcast it on all ports, we will continue to click on the same 'Capture/Forward' button.  As a result, it will broadcast it on all the ports, except the port from which it receives this frame.

ARP Broadcast

NOTE:  You need to remember that in real-time, all the movement of traffic happens automatically.  It is only for the sake of demonstration, we are making it move step-by-step in the simulation mode

On the Hub-1 the Inbound and Outbound PDUs are same, you can see in the figure:

PDU on hub

Step 6

When the PC-2 will receive  ARP frame, the following processes will be happening on it: 

Ethernet Header

In Layer 2:

  1. The frame's destination MAC address matches the receiving port's MAC address, the broadcast address, or multicast address.
  2. The device decapsulates the PDU from the Ethernet frame.
  3. The frame is an ARP frame. The ARP process processes it.
  4. The ARP frame is request.
  5. The ARP request's target IP address does not match the receiving port's address.
  6. The ARP process drops the frame.

Step 7

When the PC-1 will receive  ARP frame, the following processes will be happening on it:

 PDU Information

In Layer 1:

  1. FastEthernet0 receives the frame.

In Layer 2:

  1. The frame's destination MAC address matches the receiving port's MAC address, the broadcast address, or multicast address.
  2. The device decapsulates the PDU from the Ethernet frame.
  3. The frame is an ARP frame. The ARP process processes it.
  4. The ARP frame is request.
  5. The ARP request's target IP address matches the receiving port's IP address.
  6. The ARP process updates the ARP table with received information.

This is the time, when we will click again on 'Capture/Forward' button in simulation mode. That will trigger the ARP reply from PC-1 to Hub-1.

Out Layer 2 of PC-1:

  1. The ARP process replies to the request with the receiving port's MAC address.
  2. The device encapsulates the PDU into an Ethernet frame.

Out Layer 1:

  1. FastEthernet0 sends out the frame.

Step 8

Hub-1 has already received a ARP Reply from PC-1.

In order to forward this ARP Reply to PC-2 and PC-3, we will click again on 'Capture/Forward' button of simulation mode.

The following processes will be happening on Hub-1:

PDU Information

Step 9

Now the PC-3 has the ARP Reply and it will fill this entry in its ARP table for PC-1.

Next, we will again click on 'Capture/Forward' button of simulation mode, so that PC-3 can send a ICMP packet for PC-1.

ICMP Packet

Step 10

 Now we will again click on 'Capture/Forward' button of simulation mode, so that PC-1 can send a ICMP reply to the PC-3.

Accepted ICMP or ICMP Reply

Step 11 Testing

This is the final step where we will test the ARP entries in the ARP Tables of PC-1, PC-2, and PC-3. 

ARP Table 1

ARP table

ARP Entries

Did you observe that on PC-2 there is no entry in the ARP Table? Why?

The reason is that the communication happened between PC-1 and PC-3. 

You are welcome to share your opinion about this article. 

Thanks.


REGISTER FOR FREE ONLINE DEMO

Testing

NOTE:

Users who have attempted to register for Free Online Demo between 30-July-2016 and 28-Aug-2016, are requested to kindly register again, as previous requests were not received because of a bug.  We regret your inconvenience.  Thanks!

 


Print Email

Comments   
security for macs
0 # How Does Address Resolution Protocol (ARP) Work? - A Demonstrationsecurity for macs 2016-07-22 22:33
Great story it is without doubt. We have been awaiting
for this content.
Reply | Reply with quote | Quote
Add comment
Kindly use 'Add Comment' section, if you feel that your comment stands at its own. In case, you wish to reply to the comment(s) made by other users of the website, you may use the 'Reply' options given underneath each comment.

FORM HELP EXAMPLE:

Prof. Ashok Menon (in Name field)
http://www.yahoo.com (in Website field, if any)
HOD - Mechanical Engineering at ABC Institute of Engineering, Mumbai (in Job Title field)


COMMENT POLICY

Luminis Consulting Services promotes a receptive, transparent and civil atmosphere for comments and users. Critical, in-depth and intelligent discussions and debates are encouraged and the best of these are highlighted in various ways, such as Homepage display etc. Everyone is welcome and encouraged to voice their opinion regardless of identity, politics, ideology, religion or agreement with other community members, the author of the post or staff members as long as those opinions are respectful and constructively add to the conversation.

However, this community does not tolerate direct or indirect attacks, name-calling or insults, nor does it tolerate intentional attempts to derail, hijack, troll or bait others into an emotional response. These types of comments will be removed from the community where warranted. To maintain a civil atmosphere, our moderation team may read comments before they are displayed to other users, as we strive to get to all comments as quickly as possible. However, Luminis Consulting Services reserves the right to add, delete, edit or act upon the comments made by any user. Thanks!

x
x

Blog Subscription Image

 

 

 

 

I want to subscribe to following blogs: *

IT & Networking Blog
Process Improvement Blog
Leadership Management Blog
Education Training Blog