How Does Address Resolution Protocol (ARP) Work? - A Demonstration

Written by Meena. Posted in IT & Networking Blog

Everyone who is in the networking field, knows about Address Resolution Protocol (ARP).

In the beginning of my IT career, when I started to study the networking, I struggled to understand and remember the definition of ARP.   I had some questions frequently arising in my mind, e.g.,

Here I take this opportunity to present you a good explanation of ARP and how it works.

What is ARP?

Address Resolution Protocol (ARP) is a protocol used by the Internet Protocol (IP) [RFC826], specifically IPv4, to map IP network addresses to the hardware addresses (MAC Address) used by a data link protocol.

This definition of ARP has 2-main aspects:

  1. Used by Internet Protocol (IP)
  2. To map IP network address (IP Address) to hardware address (MAC Address)

We will explore these two main aspects of ARP  with the help of following topology which consists of 1-Hub and 3-PCs. 

Step 1

Design the topology in the Cisco Packet Tracer, assign the IP addresses to PCs and noted down the MAC addresses as shown in the below-given figure: 

ARP ICMP topology

IP Address and MAC Address

Step 2

Check the ARP table of PC-1, PC-2, and PC-3 with the help of arp –a command on the ‘Command Prompt’. If you find any entry in it, then use the command arp –d to clear the entry or entries of ARP table. 

ARP Table

Step 3

In this step, we will ping the PC-1 from PC-3. On the PC-3 open the ‘Traffic Generator’. 

Fill the following information in the Traffic Generator:

Traffic Generator will send the traffic (ping) to the destination.

Traffic Generator

From Step-4 to Step-10, we will observe that --how the ARP is working actually.

Step 4

To observe the traffic closely, select the ‘Simulation Mode’ and in the Simulation Panel click on ‘Capture/Forward’ button.

Simulation Panel

Observe the main window of Packet Tracer and the Event List of Simulation Panel.

ARP Packet and ICMP Packet

 Two types of packets will appear on PC-3:

We intended to generate ping traffic only.  Right!  BUT why does ARP Packet come along with it.....??.....???

This is because, before sending the ICMP packets to the destination (PC-1 here) on the LAN, the MAC address of the destination device, should be in the ARP table of the source device (PC-3 here).

As we know the ARP table of the PC-3 is empty, that's why ARP will first collect the MAC address of the destination device, only then the ICMP will be able to send its traffic to destination device.

Let us click on the blue square in Simulation Panel, which is representing ICMP. It will open PDU Information box.

In the PDU information at Device PC-3, you can see how the PDUs are traversing between the OSI Layers.

Simulation Panel

It clearly shows--what is happening at 'Out Layer 3' of PC-3:

  1. The Ping process starts the next ping request.
  2. The Ping process creates an ICMP Echo Request message and sends it to the lower process.
  3. The device sets TTL in the packet header.
  4. The destination IP address is in the same subnet. The device sets the next-hop to destination.

PDU

At Out Layer 2:

  1. The next-hop IP address is a unicast. The ARP process looks it up in the ARP table.
  2. The next-hop IP address is not in the ARP table. The ARP process tries to send an ARP request for that IP address and buffers this packet.
  3. The ARP process constructs a request for the target IP address.
  4. The device encapsulates the PDU into an Ethernet frame.

Out Layer 1:

  1. FastEthernet0 sends out the frame.

Featured Article


Step 5

Now we will click on 'Capture/Forward' button to send ARP traffic from PC-3 to Hub-1.

 ARP Packet sent

When the Hub will receive the ARP frame, it actually stops here.  In order to broadcast it on all ports, we will continue to click on the same 'Capture/Forward' button.  As a result, it will broadcast it on all the ports, except the port from which it receives this frame.

ARP Broadcast

NOTE:  You need to remember that in real-time, all the movement of traffic happens automatically.  It is only for the sake of demonstration, we are making it move step-by-step in the simulation mode

On the Hub-1 the Inbound and Outbound PDUs are same, you can see in the figure:

PDU on hub

Step 6

When the PC-2 will receive  ARP frame, the following processes will be happening on it: 

Ethernet Header

In Layer 2:

  1. The frame's destination MAC address matches the receiving port's MAC address, the broadcast address, or multicast address.
  2. The device decapsulates the PDU from the Ethernet frame.
  3. The frame is an ARP frame. The ARP process processes it.
  4. The ARP frame is request.
  5. The ARP request's target IP address does not match the receiving port's address.
  6. The ARP process drops the frame.

Step 7

When the PC-1 will receive  ARP frame, the following processes will be happening on it:

 PDU Information

In Layer 1:

  1. FastEthernet0 receives the frame.

In Layer 2:

  1. The frame's destination MAC address matches the receiving port's MAC address, the broadcast address, or multicast address.
  2. The device decapsulates the PDU from the Ethernet frame.
  3. The frame is an ARP frame. The ARP process processes it.
  4. The ARP frame is request.
  5. The ARP request's target IP address matches the receiving port's IP address.
  6. The ARP process updates the ARP table with received information.

This is the time, when we will click again on 'Capture/Forward' button in simulation mode. That will trigger the ARP reply from PC-1 to Hub-1.

Out Layer 2 of PC-1:

  1. The ARP process replies to the request with the receiving port's MAC address.
  2. The device encapsulates the PDU into an Ethernet frame.

Out Layer 1:

  1. FastEthernet0 sends out the frame.

Step 8

Hub-1 has already received a ARP Reply from PC-1.

In order to forward this ARP Reply to PC-2 and PC-3, we will click again on 'Capture/Forward' button of simulation mode.

The following processes will be happening on Hub-1:

PDU Information

Step 9

Now the PC-3 has the ARP Reply and it will fill this entry in its ARP table for PC-1.

Next, we will again click on 'Capture/Forward' button of simulation mode, so that PC-3 can send a ICMP packet for PC-1.

ICMP Packet

Step 10

 Now we will again click on 'Capture/Forward' button of simulation mode, so that PC-1 can send a ICMP reply to the PC-3.

Accepted ICMP or ICMP Reply

Step 11 Testing

This is the final step where we will test the ARP entries in the ARP Tables of PC-1, PC-2, and PC-3. 

ARP Table 1

ARP table

ARP Entries

Did you observe that on PC-2 there is no entry in the ARP Table? Why?

The reason is that the communication happened between PC-1 and PC-3. 

You are welcome to share your opinion about this article. 

Thanks.


REGISTER FOR FREE ONLINE DEMO

Testing

NOTE:

Users who have attempted to register for Free Online Demo between 30-July-2016 and 28-Aug-2016, are requested to kindly register again, as previous requests were not received because of a bug.  We regret your inconvenience.  Thanks!

 


Print

x
x

Blog Subscription Image

 

 

 

 

I want to subscribe to following blogs: *

IT & Networking Blog
Process Improvement Blog
Leadership Management Blog
Education Training Blog