ARP (Address Resolution Protocol)
ARP
Table of Contents:-
1.
Introduction.
2.
Simplified Explanation of Packet Flow at
L3 and L2.
3.
Why do we need ARP.
4.
What is ARP and How does It work.
5.
ARP Header.
6.
Flow of ARP.
7.
The FOUR cases of ARP.
8.
Questions asked from ARP in the Network
Engineer L1 Interview.
Ÿ Having read in the OSI Model you must be knowing that Layer
3 that is your network layer is responsible for end-to-end delivery of the
packet whereas L2 is responsible for the next hop delivery of the packet.
Ÿ Although ARP is a Layer 2 protocol but I consider it to be
working somewhere in between L3 and L2.
Ÿ Before understanding ARP let me explain you an overview of
the packet flow according to L3 and L2.
** Considering
1,2,11,12,21,22 as the IP’s and A,B,C,D,E,F as the Mac addresses. Although
things are now like this but just to keep things simple lets assume.
l From the above diagram when PC1 pings
PC2-
1. The encapsulation takes place on PC1-
On the L3 IP header is being added with source IP- 1 and destination IP- 22. After
that on the L2, source MAC- A and destination MAC- F is added.
2. Now as I stated above the L2 is
responsible for next hop delivery, the destination MAC will be of the next device
the packet will go to the next device that is the router.
After these encapsulations the packet is sent to router or next hop.
3. Now as the router receives the packet
it would start decapsulation which is being done from the bottom to the top.
As it decapsulates L2- It matches the destination MAC with its own MAC.
If it matches it would move further else it would drop the traffic thinking its
not meant for me.
4. Once MAC matches it would further
decapsulate L3 where it would check the destination IP and find the particular
address into its routing table if it has route for that network or IP and if it
has, it would check the nexthop in the route else it would drop.
5. Once next hop is identified the
router starts encapsulation where it wraps IP header as it is and on the L2 it
adds the source MAC of its own exit interface- C and in the destination MAC it
adds the MAC of next hop- D So that the
packet could move forward.
**
This process goes on till the packet is being delivered to the final
destination.
l Why do we need ARP ?
As explained
to send any traffic from one device to another you need the logical address as
well as the physical address ( Source MAC and Destination MAC ).
So, source
IP would be known through the DHCP/ Manually configured, destination IP would
be known through the routing table, source MAC would be known through the NIC
card installed the source PC but how would the destination MAC be known to the
sender and without the destination MAC the packet cannot move forward.
This is
where the ARP comes into play. ARP
resolves the destination MAC of the destination.
l What is ARP and how does it work ?
ARP is a
layer 2 protocol which is used to resolve the MAC address of the destination.
Whenever, the traffic needs to be sent to a device the source checks its ARP
table for the receivers MAC address and if it is not found there then the ARP
request is raised to resolve the MAC address of the destination.
**
The ARP request is broadcast whereas the ARP reply is unicast.
l Below is the
ARP Header:-
|
Hardware
Type |
Protocol
Type |
|
|
Hardware
Length |
Protocol
Length |
Operation (Request-
1, Reply- 2) |
|
Sender
Hardware Address (Source Mac ) |
||
|
Sender
Protocol Address (Source IP ) |
||
|
Target
Hardware Address (Destination Mac) |
||
|
Target
Protocol Address (Destination IP) |
||
Only some
sections are important from L1 interview perspective. So, I will be discussing
those only, rest if you want knowledge regarding the complete Header then you
can refer other documents available on the internet and for deep knowledge you
can go through the RFC.
1. Operation- This is a 16-bit field that defines that the packet
is a ARP request or ARP reply. For arp request the operation code is 1 and for
the arp reply it is 2.
2. Sender Hardware Address- This is the field where the source
mac will be written.
3. Sender Protocol Address- This is the field for source IP.
4. Target Hardware Address- This section is responsible for
Target’s mac address. It is filled by 0’s when the arp request is being send
and the receiver reverts back with his mac address filled in this field.
5. Target Protocol Address- With the arp perspective or
interview or understanding perspective this the most important field. In this
field the IP address of the device of which the mac address needs to be
resolved is provided. This will keep on changing with the different scenarios
or situations.
l Flow of ARP:-
1. The sender is aware of the target's IP address.
2. IP requests ARP to
generate an ARP request with the Target Physical Address field populated with
0's.
3. The transmission is sent to the data link layer, where the ARP Header
is enclosed within a frame using the sender's physical address as the source
address and the physical broadcast ( FFFFFFFFF…) address as the destination address.
4. Each frame is received by every host or router in that particular
network because of the broadcast destination address. Each device reads the
target IP address in the ARP Header and matches it with its own IP address. Whichever
device finds a match with the target IP, creates a ARP reply packet (which
includes the Physical address of the Target machine) and unicast’s it.
5. The sender gets the response and saves it in its cache so that when
the next time any data needs to be sent to that particular destination, It
doesn’t have to resolve the Mac address through ARP.
Next time, it would just check for the Mac in its cache memory and it
will find it there.
6. The IP datagram is currently enclosed in a
frame and sent directly to the destination.
l Now let us discuss the four cases of ARP:-
Lets consider a complete scenario below and we'll describe the four cases of Arp taking this scenario as an example-
Case 1:- The packet needs to be sent to the Host in the same network- ( This case is a bit different from the above scenario).
Q. But the question is how would the
ARP know that the destination is in the same network or different network?
Ans:- ARP runs a process called AND OPERATION to check if the destination is in the same
network or different from that of Host. AND operation is performed between the
destination IP and own subnet mask.
The Target IP address in the ARP Header would be the IP address of the destination Host.
Case 2:- The packet needs to be sent to a Host in another network-
## In this
case the host looks at its routing table to find the IP address of the next hop
(router) for this destination. If it doesn’t have a routing table it looks IP
address of default router.
The target
IP address in the ARP Header would be the IP address of the Router which is responsible
for the inter network communication. By resolving the Mac of the router the
packet would be sent to the router and the further process would be carried out
by the router.
Case 3:- Sender is a router that has received
datagram destined for a host on another network-
## It checks
its routing table and finds the IP address of the next router.
So, the
Target IP address in the ARP Header here would be the IP address of appropriate
router found in the routing table.
Case 4:- Sender is a router that has received
a datagram destined for a host on the same network-
The Target
IP address in the ARP Header would be the Destination IP address provided in
the IP datagram or Packet.
** This much
is enough for this Blog. Now there is one part left for ARP that is types of
ARP.
I would be
discussing those in the next blog. I’ll state below the questions being asked
in the L1 interview from this particular part I have explained in this blog.
l Network Engineer L1 interview Questions from ARP:-
1. What is ARP? Define its role?
2. Define the working of ARP?
3. What would be filled at the place of target Mac/Physical address in the
ARP Header?
4. A scenario could be presented to you or a diagram and you could be
asked to provide the target IP address of the ARP header? So to answer this you
have to remember the ARP flow + packet flow + the four cases of Arp ( I have
explained all these things above ).
5. Is ARP request-
unicast/broadcast/multicast? Answer-
Broadcast.
6. Is ARP reply- unicast/broadcast/multicast? Answer- Unicast.
7. How does the source check if the destination is in the same subnet or
different?
Comments
Post a Comment