ARP (Address Resolution Protocol) is a protocol used for resolving IP addresses into link layer addresses.
Some may wonder, why does ARP’s function involve translating IP addresses into physical addresses?
For this question, we need to refer to the OSI seven-layer model. I won’t go into much detail about the OSI model. The IP address is located on the third layer, which is the network layer, while the MAC address is on the second layer, the data link layer. They cannot directly communicate with each other. When sending IP packets over Ethernet, both the IP address and MAC address need to be encapsulated in the header. However, while the sender knows the destination’s IP address, it does not know the destination’s MAC address. Knowing each other’s MAC address is essential for communication, necessitating the use of the ARP protocol.
Now that we understand ARP’s purpose, let’s explore its workflow and how it functions.
As shown in the image above, ARP operates in two stages: ARP Request and ARP Response.
Assume that PC1 has the IP address 192.168.1.1, and PC2 has the IP address 192.168.1.2. When PC1 wants to send data to PC2:
(1) PC1 checks its local ARP cache table for the MAC address corresponding to PC2’s IP address.
(2) If a matching MAC address is not found in its local ARP cache table, PC1 broadcasts the ARP request frame to all hosts on the local network. Upon receiving the ARP request, all hosts check if the request matches their IP address. If it doesn’t match, they discard the request.
(3) PC2 receives the ARP request and, recognizing that the requested IP address matches its own, adds PC1’s IP and MAC addresses to its local ARP cache table.
(4) PC2 then sends an ARP response packet containing its MAC address back to PC1. This is a unicast packet.
(5) Upon receiving the ARP response packet from PC2, PC1 adds PC2’s IP and MAC addresses to its local ARP cache table. Note that this entry is not permanent; by default, it is valid for 120 seconds and will be deleted after the timeout, at which point the process will restart.
Some may also ask, what is an ARP cache table and what is its purpose?
The ARP cache table is a table that records entries of IP addresses and their corresponding resolved MAC addresses. In a local area network with anywhere from a few to hundreds of computers, it is impractical to fetch the MAC address every time a device communicates, hence the need for an ARP cache table.
You can view the ARP cache using the ARP command on Windows.
You can display the ARP table using arp -a.
“`