NETWORKING-ARP protocol

ARP Protocol Overview

ARP (Address Resolution Protocol), which is a URL resolution protocol, is used to map IP addresses to physical addresses. Each host on the network segment maintains a table called ARP table or ARP Cache, which contains the corresponding relationship between the IP address of the other host on the network segment and the physical address. When the host needs to send data to other hosts on the network segment, it looks at the ARP Cache to obtain the physical address of the destination. The ARP cache is dynamically changing. If the address to receive data does not currently exist in the ARP Cache, the host broadcasts an ARP request frame. The ARP request frame contains an unresolved IP address and also contains the IP address and physical address of the host that sent the request. The other host on the network segment receives this ARP request, and the host that has the unresolved IP address sends its own physical address to the requesting hosts. The correspondence between this new IP address and the physical address is added to the ARP Cache of the requesting host. In general, entries in the ARP Cache expire after a certain amount of time, and entries are deleted from the table. When the host needs to send data to the IP addresses contained in this entry, the parsing process repeats again.

ARP Message Format

The ARP message format is as follows:

Htype

PTYPE

Hlen

Plen

OPER

SHA

SPA

THA

Tpa

Htype (Hardware type): This field has 2 bytes, which represents the hardware type.

PTYPE (Protocol type): This field has 2 bytes, which represents the protocol type.

Hlen (Hardware address length): This field has 1 bytes, which indicates the hardware address length.

Plen (Protocol address length): This field has 1 bytes, which represents the protocol address length.

OPER (operation): This field has 2 bytes representing the type of operation. 1 represents an ARP request, and 2 represents an ARP reply.

SHA (Sender Hardware address): This field has 6 bytes, which represents the sender's hardware addresses.

SPA (Sender Protocol address): This field has 4 bytes, which represents the sender's IP address.

THA (target Hardware address): This field has 6 bytes, which represents the destination hardware addresses.

TPA (target Protocol address): This field has 4 bytes, which represents the destination IP address.

ARP Working process

The following uses Wireshark to analyze the working process of ARP. Test machine: Sender machine (IP address: 10.21.28.47,mac Address: 68:F7:28:0F:32:2E) hereinafter referred to as HOSTA; target machine (IP address: 10.21.28.110,mac address: 54:EE:75:25:33:FD) , hereinafter referred to as HOSTB.

1. Locate the data packet using the "arp and eth.addr = = 68:f7:28:0f:32:2e" filter rule.  Observing a data frame numbered 2370, the MAC address for 68:F7:28:0F:32:2E broadcasts an ARP request frame, asking "who has 10.21.28.110?" Tell 10.21.28.47. "

2. Observe the contents of the no.2370 Ethernet II data frame. The source MAC address is 68:f7:28:0f:32:2e, the destination MAC address is FF:FF:FF:FF:FF:FF (broadcast), and the packet type ARP (0x0806).

3. Observe the contents of the no.2370 ARP packet. The value of Opcode is 1, which indicates that this is an ARP request. The source MAC address is 68:f7:28:0f:32:2e, the source IP address is 10.21.28.47, and the destination IP address is 10.21.28.110. It's like HOSTA to the other hosts in the network segment. "Hello, my MAC address is 68:f7:28:0f:32:2e,ip address is 10.21.28.47,IP address is the host's MAC address is how many ah, can stand up and say to me For a second? ”。

4. Observe the data frame numbered 2371, MAC address 54:EE:75:25:33:FD host responds to 68:f7:28:0f:32:2e: "10.21.28.110 is at 54:EE:75:25:33:FD".

5. Observe the contents of the no.2371 ARP packet. The value of Opcode is 2, which indicates that this is an ARP reply. The source MAC address is 54:EE:75:25:33:FD, the source IP address is 10.21.28.110, the destination MAC address is 68:f7:28:0f:32:2e, and the destination IP address is 10.21.28.47. After HostB receives the HOSTA ARP request, it discovers that the IP address HOSTA asked for is the IP address of 10.21.28.110. In response to HOSTA said "10.21.28.110 is my IP address, my MAC address is 54:ee:75:25:33:fd." ”

6. Once the HOSTA receives the HOSTB response, it can update the HOSTA ARP Cache.

NETWORKING-ARP protocol