Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) is used by IP devices to locate the hardware addresses of other devices on the local network. RFC 826 introduced ARP as a method for IP devices to locate other IP devices on the same local network by Ethernet hardware address. RFC 1122 clarified RFC 826 further,and a correct ARP implementation needs to incorporate both RFC 826 and RFC 1122.

ARP is required for IPv4-enabled systems to communicate with each other. ARP packets function at the data-link layer and are a separate entity from IP packets. ARP packets have a protocol ID of 0806 whereas IP packets have a protocol ID of 0800.

If a host on an IP network needs to communicate with another host, it will first check to see if it knows the hardware address of the destination host. If it does, the source host simply transmits the data to the destination host. However, if the destination host’s hardware address is not known then the IP software on the source host issues a broadcast Ethernet frame containing an ARP request with the destination host’s IP address. If the destination host is present and powered-on, it will see the broadcast, and it will return an unicast ARP response back to the source host.

The five main fields of an ARP packet are:

1. Source Hardware Address
2. Source IP Address
3. Destination Hardware Address
4. Destination IP Address
5. Message Type (identifies if packet is a request or a response)

When the source host issues an ARP request, it provides its own IP address and hardware address in the packet. Additionally, it provides the destination host’s IP address and sets the “Message Type” field. The destination host hardware address will be all 0’s (48-bit mac-address). All hosts on the local network will monitor for ARP broadcasts; since the destination host’s IP address is contained in the request packet, the destination host will know that the request is meant for it.

When a response is sent back from the destination host to the local source host, it will contain the local source’s IP address as well as the hardware address. It will also contain the same information for the local destination host; the “Message Type” field will also be set to identify the packet as an ARP response.