ARP (Address Resolution Protocol) explained

If you learned about the OSI Model and encapsulation / decapsulation you know that when two computers on the LAN want to communicate with each other the following will happen:

  • An IP packet is created with a source and destination IP address carrying the data from an application.
  • The IP packet will be encapsulated in an Ethernet frame with a source and destination MAC address.

The sending computer will of course know its source MAC address but how does it know the destination MAC address? That’s where ARP comes into play. Let me show you an example:

Two Computers

In the picture above we have two computers, computer A and computer B and you can see their IP addresses and their MAC addresses.

We are sitting behind computer A, open up a command prompt and type:

C:\\Users\\ComputerA>ping 192.168.1.2 
Pinging 192.168.1.2 with 32 bytes of data:
Reply from 192.168.1.2: bytes=32 time=15ms TTL=57
Reply from 192.168.1.2: bytes=32 time=15ms TTL=57
Reply from 192.168.1.2: bytes=32 time=14ms TTL=57
Reply from 192.168.1.2: bytes=32 time=17ms TTL=57

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 14ms, Maximum = 17ms, Average = 15ms

You know about the OSI-model and also know we have to go through all the layers.

Ping uses the ICMP protocol and IP uses the network layer (layer 3). Our IP packet will have a source IP address of 192.168.1.1 and a destination IP address of 192.168.1.2. Next step will be to put our IP packet in an Ethernet frame where we set our source MAC address AAA and destination MAC address BBB.

Now wait a second…how does computer A know about the MAC address of computer B? We know the IP address because we typed it but there is no way for computer A to know the MAC address of computer B. There is another protocol we have that will solve this problem for us, it’s called ARP (Address Resolution Protocol). Let me show you how it works:

C:\\Users\\ComputerA>arp -a

Interface: 192.168.1.1 --- 0xb
  Internet Address      Physical Address      Type
  192.168.1.2           00-0c-29-63-af-d0     dynamic
  192.168.1  .255       ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.252           01-00-5e-00-00-fc     static
  239.255.255.250       01-00-5e-7f-ff-fa     static
  255.255.255.255       ff-ff-ff-ff-ff-ff     static

In the example above you see an example of an ARP table on a Computer A. As you can see there is only one entry, this computer has learned that the IP address 192.168.1.2 has been mapped to the MAC address 00:0C:29:63:AF:D0.

Let’s take a more detailed look at ARP and how it functions:

ARP Request

In this example we have two computers and you can see their IP address and MAC address. We are sitting behind computer A and we want to send a ping to computer B. The ARP table is empty so we have no clue what the MAC address of computer B is. The first thing that will happen is that computer A will send an ARP Request. This message basically says “Who has 192.168.1.2 and what is your MAC address?” Since we don’t know the MAC address we will use the broadcast MAC address for the destination (FF:FF:FF:FF:FF:FF). This message will reach all computers in the network.

ARP Reply

 

Computer B will reply with a message ARP Reply and is basically saying “that’s me! And this is my MAC address”. Computer A can now add the MAC address to its ARP table and start forwarding data towards computer B.

If you want to see this in action you can look at it in Wireshark:

ARP in Wireshark

Above you see the ARP request for Computer A that is looking for the IP address of Computer B. The source MAC address is the MAC address of computer A, the destination MAC address is “Broadcast” so it will be flooded on the network.

The second packet is the ARP reply. Computer B will send its MAC address to Computer A. Here’s a detailed look:

Full content of this lesson is only available to NetworkLessons.com members.

Click the button below to join today and learn any networking topic you like!

Join NetworkLessons today


Digiprove sealCopyright protected by Digiprove © 2013 Rene Molenaar

Tags: , , ,

18 Responses to “ARP (Address Resolution Protocol) explained”

  1. Rama July 31, 2013 at 8:59 am #

    Hello,

    Why in the ARP reply packet do we see 00:00:00:00:00:00 as Target MAC address instead of FF:FF:FF:FF:FF:FF ?

  2. Rama July 31, 2013 at 9:00 am #

    I meant ARP request

    • Rene Molenaar July 31, 2013 at 9:03 am #

      FF:FF:FF:FF:FF:FF in binary is all 1s…in other words, it will be broadcasted within the broadcast domain. This way the ARP request reaches all devices in the broadcast domain.

      • Rama August 1, 2013 at 9:32 am #

        I agree with that. That’s why I wonder why we see 00:00:00:00:00:00 is the ARP request screenshot…

  3. virender September 9, 2013 at 8:46 am #

    May you pls explain same scenario adding 2 switches and 2 routers in between.

    Computer A ——-Switch1—–ROUTER1——————ROUTER 2 —- Switch2 —– Computer B.

    Much Thanks !!

    • Rene Molenaar September 9, 2013 at 6:44 pm #

      Hi Virender,

      When Computer A wants to reach Computer B it will have to know how to reach its default gateway because both computers are in a different subnet. What happens is that Computer A will do an ARP request for the IP address of Router 1 (its default gateway).

      Computer B will do an ARP request for Router 2 (its default gateway).

      Router 1 and Router 2 will do ARP requests on the link that connects them to discover each others MAC addresses.

      Rene

  4. reza January 11, 2014 at 7:33 pm #

    thank you.
    why does a pc need a pc*s mac-address that is in same network?if we know its ip address so we dont need to know its mac-address.
    thank you

    • Rene Molenaar January 14, 2014 at 3:40 pm #

      Hi Reza,

      IP is a layer 3 protocol and Ethernet is a layer 2 protocol. If you want to send an IP packet on the LAN you have to put it in an Ethernet frame in order to send it. Ethernet frames use MAC addresses for identification.

      Rene

  5. reza January 14, 2014 at 8:06 pm #

    thanks Rene

  6. Taran February 7, 2014 at 8:50 pm #

    Great article Rene.
    Helped alot in understanding ARP.

    Keep up the good work.
    Thanks

  7. Schweta August 24, 2014 at 2:48 pm #

    Hello Renne,

    Thank you for all this info on Networking put up in a very simple way.

    Could you please explain what is the difference between ARP Table and Routing Table? And what is Reverse ARP?

    Thanks,
    Schweta.

  8. kiran g November 5, 2014 at 5:28 am #

    Hi Rene ,

    why do we see incomplete MAC entries when a device is connected to a CISCO Router through a switch ?

    • Rene Molenaar November 5, 2014 at 2:42 pm #

      Hi Kiran,

      Which incomplete MAC entries are you referring to? Do you have an example?

      Rene

      • kiran g November 5, 2014 at 4:42 pm #

        Hi Rene ,

        I am referring to incomplete MAC entries connected to the router.

        PNTADD01#sh arp
        Protocol Address Age (min) Hardware Addr Type Interface
        Internet 10.137.21.1 – 0000.0c07.ac01 ARPA GigabitEthernet0/0
        Internet 10.137.21.2 – a493.4cbd.3780 ARPA GigabitEthernet0/0
        Internet 10.137.21.3 0 Incomplete ARPA
        Internet 10.137.21.11 0 Incomplete ARPA
        Internet 10.137.21.12 0 Incomplete ARPA
        Internet 10.137.21.13 0 Incomplete ARPA
        Internet 10.137.21.14 0 Incomplete ARPA
        Internet 10.137.21.15 0 Incomplete ARPA

        • Rene Molenaar November 5, 2014 at 6:17 pm #

          Hi Kiran,

          Ah ok, good question.

          When the router does an ARP request but doesn’t get a ARP reply in return, it will show up as incomplete.

          Try to ping an IP address that isn’t reachable and you’ll see it in this list.

          Rene

          • kiran g November 6, 2014 at 6:31 am #

            Hi Rene ,

            Yes i am not able to ping any of those which shows as incomplete.
            I was not getting an answer from anyone on this and finally i got it from you. Thanks Rene .

            Regards
            Kiran

Trackbacks/Pingbacks

  1. Connect using MAC addr - October 3, 2013

    […] Are you creating your own program to do this? Anything special on mind why need a MAC to connect to interface. check out this link for ARP illustration: http://networklessons.com/cisco/arp-…col-explained/ […]

Leave a Reply