What Is ARP?
ARP stands for Address Resolution Protocol. It is a method of mapping a layer 3 protocol address to a layer 2 or hardware address. In most cases, ARP maps an IP address to an Ethernet MAC address.
Something to be aware of is that ARP is used with IPv4. IPv6 uses the Neighbor Discovery instead, which achieves a similar outcome, but using a different method.
Why Do We Need ARP?
To understand why we need ARP, we need to think back to the OSI model and the basics of Ethernet networks.
A host will have one or more IP addresses, which are logical addresses that belong to layer 3 of the OSI model.
When we send traffic over the physical network, we need to know the destination layer 2 physical (or MAC) address so we can put the source and destination addresses into the layer 2 frame.
We need to figure out the layer 2 (MAC) address that is associated with the IP Address we are trying to talk to.
Who Do I Need To ARP For?
If a device wants to talk to another device on the same local network, it will ARP directly for the device itself.
In general, if a device wants to talk to another device on a remote network, it will ARP for the MAC address of its configured local gateway.
How Does ARP Work?
ARP is a pretty simple request and reply protocol.
One device will make an ARP request asking who has a certain IP Address
If a device has that IP address, it will reply saying that the IP address is at this hardware address.
The requesting device will then cache that ARP entry in its ARP cache. How long an entry is held in the ARP cache depends on the operating system, but it will eventually time out and be removed.
What Layer Of The OSI Model Does ARP Belong To?
A lot of the material I studied when getting into networking showed ARP as belonging to the bottom of the Network layer – layer 3.
Since then, I’ve seen other arguments where it does make more sense for ARP to be considered a layer 2 or Data-Link layer protocol because the actual addressing of the ARP frames is layer 2 or MAC addresses. ARP doesn’t use an IP header at all.
The IP address information is carried in the payload of the ARP packet.
These days, I’d tend to call ARP layer 2, but I accept that depending on how you were taught, some will consider it layer 3.
ARP Example
The following output is based on the following topology. We will ping from Linux-Attack (10.0.0.10) to Host-1 (10.0.0.2). A quick note on the ‘arp’ command. The -n switch stops it from trying to resolve the addresses, and -i specifies which interface to show the ARP table for.
The arp command, or some variation of it, is usually available across most operating systems. For my Ubuntu machines below I had to install the net-tools package to have it available.
Linux-Attack Output
The below output shows the arp cache or arp table before and after we ping Host-1 (10.0.10.2).
eve@linux-attack:~$ arp -n -i ens4
arp: in 1 entries no match found.
eve@linux-attack:~$ ping 10.0.10.2 -c1
PING 10.0.10.2 (10.0.10.2) 56(84) bytes of data.
64 bytes from 10.0.10.2: icmp_seq=1 ttl=64 time=312 ms
--- 10.0.10.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 311.936/311.936/311.936/0.000 ms
eve@linux-attack:~$ arp -n -i ens4
Address HWtype HWaddress Flags Mask Iface
10.0.10.2 ether aa:bb:cc:00:10:02 C ens4
eve@linux-attack:~$Host-1 Output
Again – showing the ARP table before and after it has been pinged by Linux-Attack (10.0.10.10).
eve@Host-1:~$ arp -n -i ens4
arp: in 1 entries no match found.
eve@Host-1:~$ arp -n -i ens4
Address HWtype HWaddress Flags Mask Iface
10.0.10.10 ether aa:bb:cc:00:10:10 C ens4
eve@Host-1:~$ The Packet Capture
Below is the overall packet capture of this interaction.
You can see Linux-Attack ARPing for Host-1, followed by the ping (ICMP Echo Request and Echo Reply). Finally, there is another ARP from Host-1 directed to Linux-Attack.
Next, let’s look at the details of these packets.
You can see the fields of an ARP request packet below.
A few key features are:
- Source MAC Address: Set to the MAC of the requesting device
- Destination MAC Address: The broadcast address of all ones – ff:ff:ff:ff:ff:ff
- In the ARP payload, the sender’s MAC and IP Address are set to those of the requesting device
- The Target MAC is set to all zeroes – 00:00:00:00:00:00
- The Target IP Address is set to the address we want to find the MAC address for
And now the ARP reply packet.
- Source MAC Address: Set to the MAC of the replying device
- Destination MAC Address: The address of the requestor
- In the ARP payload, the sender MAC and IP Address are set to those of the replying device
- The Target MAC and IP Address fields are set to the requesting device (the one that sent the request)
After the first set of request/reply messages, there was a second interaction where Host-1 (10.0.10.2) ARPed for Linux-Attack (10.0.10.10)
These are shown below.
This time the request is unicast direct to Linux-Attack, instead of being a layer 2 broadcast. Otherwise, the fields of the ARP request and reply are similar to the previous ones shown above.
Putting It All Together
Now that we know how ARP works, let’s start putting the whole process together.
When we make a device connect to another one it will:
- determine if the destination IP address is on its local network or not
- If it is on the local network it will check its ARP cache, if it already has an entry it can send the traffic
- If it does not have an ARP entry, it will ARP for the destination address
- If the destination IP address is on a remote network
- Perform a route lookup to find the next hop to send it to, which in most cases is the default gateway
- Check the ARP cache for an entry for the next hop, if it already has an entry send the traffic
- If it does not have an entry, ARP for the address of the next hop, again, usually the default gateway.
What If I ARP For An Address That Is Not In Use?
What if we ARP for an address that isn’t currently in use? There won’t be a response back, so we get an incomplete ARP entry in the table. This is shown below when we try to ping from Linux-Attack to an address that is not in use.
eve@linux-attack:~$ arp -n -i ens4
arp: in 1 entries no match found.
eve@linux-attack:~$ ping 10.0.10.8 -c2
PING 10.0.10.8 (10.0.10.8) 56(84) bytes of data.
From 10.0.10.10 icmp_seq=1 Destination Host Unreachable
From 10.0.10.10 icmp_seq=2 Destination Host Unreachable
--- 10.0.10.8 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1027ms
pipe 2
eve@linux-attack:~$ arp -n -i ens4
Address HWtype HWaddress Flags Mask Iface
10.0.10.8 (incomplete) ens4
eve@linux-attack:~$Further Reading
For more about ARP, you can look at: