[TCP/IP explanation: Study Notes] ARP: Address Resolution Protocol

ARP: Address Resolution Protocol

When a host sends an Ethernet data frame to another host located on the same LAN, the destination interface is determined based on the 48-bit ethernet address. Device DriverProgramNever check the destination IP address in the IP datagram.

The IP address resolved to a 32-bit IP address and any type of IP address used by the data link layer provides dynamic ing. RFC 826 is the description of ARP specifications.

 

An example is used to explain the ARP running process.

Enter the following command:

% FTP bsdi

The following steps are performed:

 

Figure 1 ARP operations when the user enters the "FTP host name"

1. The FTP client of the application calls the gethostbyname function to convert the Host Name (bsdi) to a 32-bit IP address. This function becomes a parser in the DNS system;
2. The FTP client uses the obtained IP address to establish a TCP connection;
3. TCP sends a connection request to a remote host in segments, that is, an IP datagram is sent using the above IP address;
4. If the destination host is on the local network, IP datagram can be directly sent to the destination host. If the destination host is on a remote network, then, the IP address routing function is used to determine the next route address on the local network;
5. Assume that it is an Ethernet, the sender must change the 32-bit IP address to a 48-bit ethernet address. Process translation is required from the logical Internet address to the corresponding physical hardware address. This is the ARP function;
6. ARP sends an Ethernet data frame of an ARP request to each host on the Ethernet. This process is called broadcast. The ARP request data frame contains the IP address of the target host. If you are the owner of the IP address, please reply to your hardware address;
7. The ARP layer of the target host identifies that the broadcast is the hardware address that the sender is asking for, and then sends an ARP response. The destination host's ARP layer has es this broadcast, recognizes that the sender is asking for its hardware address, and replies withARP reply.The ARP response contains the IP address and the corresponding hardware address.
8. After receiving the ARP response, make ARP request-the IP datagram for the reply exchange can be sent now;
9. Send IP data to the destination address.

 

The interface address (hardware address) must be correct for data exchange at the hardware level ). The kernel (such as the Ethernet driver) must know the hardware address of the target end to send data (this statement also explains the meaning of ARP ). Each host has an ARP high-speed cache to store the ing records from the nearest Internet address to the hardware address. The survival time of each item in the cache is generally 20 minutes, And the start time starts from the time when it is created (the survival time is updated to 20 minutes after it is used again ).

 

ARP grouping format

The format of ARP request and Response Group 2 is shown in.

 

Figure 2 format of ARP request or response for Ethernet

 

1. The first two fields in the Ethernet header are the Source and Destination addresses of the Ethernet. Specifically, the special address with the destination address all being 1 is the broadcast address;
2. The Ethernet frame type indicates the type of the subsequent data. For ARP requests or responses, the value of this field is 0x0806;
3. The hardware type field indicates the hardware address type. If the value is 1, it indicates the ethernet address;
4. The protocol type field indicates the Protocol address type to be mapped, and its value is 0x0800, which indicates the IP address. The value is the same as the value of the type field in the Ethernet data frame containing the IP datagram;
5. The length of the hardware address and the Protocol address respectively indicate the length of the hardware address and the Protocol address, in bytes. For ARP requests or responses from IP addresses over Ethernet, their values are 6 and 4 respectively;
6. The operation field indicates four operation types, namely, ARP request (value: 1), ARP response (value: 2), and RARP request (value: 3), RARP response (value: 4 );
7. The following four fields are the sender's hardware address, the sender's Protocol address (IP address), the destination's hardware address, and the destination's Protocol address.

 

ARP request and Response Process

For an ARP request, all fields except the destination hardware address have a fill value. After the system receives an ARP request message from the target machine, it fills in the hardware address and replaces the two Sending addresses with the two destination addresses, set the operation field to 2 and send it back.

 

If an ARP request is sent from a network host to a host on another network, the router connected to the two networks can answer the request. This process is called entrusting ARP or ARP proxy. The ARP proxy can hide the physical network through the routers between two physical networks.