Presented by:
SANDEEP SWAIN

---

[attachment=9620]
Address Resolution Protocol
ABSTRACT
The address resolution protocol (arp) is a protocol used by the Internet Protocol (IP), specifically IPv4, to map IP network adsdresses to the hardware addresses used by a data page link protocol. The protocol operates below the network layer as a part of the interface between the OSI network and OSI page link layer. It is used when IPv4 is used over Ethernet The term address resolution refers to the process of finding an address of a computer in a network. The address is "resolved" using a protocol in which a piece of information is sent by a client process executing on the local computer to a server process executing on a remote computer. The information received by the server allows the server to uniquely identify the network system for which the address was required and therefore to provide the required address. The address resolution procedure is completed when the client receives a response from the server containing the required address.
1. INTRODUCTION
The address resolution protocol (arp) is a protocol used by the Internet Protocol (IP), specifically IPv4, to map IP network adsdresses to the hardware addresses used by a data page link protocol. The protocol operates below the network layer as a part of the interface between the OSI network and OSI page link layer. It is used when IPv4 is used over Ethernet.
The term address resolution refers to the process of finding an address of a computer in a network. The address is "resolved" using a protocol in which a piece of information is sent by a client process executing on the local computer to a server process executing on a remote computer. The information received by the server allows the server to uniquely identify the network system for which the address was required and therefore to provide the required address. The address resolution procedure is completed when the client receives a response from the server containing the required address.
An Ethernet network uses two hardware addresses which identify the source and destination of each frame sent by the Ethernet. The destination address (all 1's) may also identify a broadcast packet (to be sent to all connected computers). The hardware address is also known as the Medium Access Control (MAC) address, in reference to the standards which define Ethernet. Each computer network interface card is allocated a globally unique 6 byte page link address when the factory manufactures the card (stored in a PROM). This is the normal page link source address used by an interface. A computer sends all packets which it creates with its own hardware source page link address, and receives all packets which match the same hardware address in the destination field or one (or more) pre-selected broadcast/multicast addresses.
The Ethernet address is a page link layer address and is dependent on the interface card which is used. IP operates at the network layer and is not concerned with the page link addresses of individual nodes which are to be used. The address resolution protocol (arp) is therefore used to translate between the two types of address. The arp client and server processes operate on all computers using IP over Ethernet. The processes are normally implemented as part of the software driver that drives the network interface card.
There are four types of arp messages that may be sent by the arp protocol. These are identified by four values in the "operation" field of an arp message. The types of message are:
1. ARP request
2. ARP reply
3. RARP request
4. RARP reply
The format of an arp message is shown below:
Fig 1 Format of an arp message used to resolve the remote MAC Hardware Address (HA)
To reduce the number of address resolution requests, a client normally caches resolved addresses for a (short) period of time. The arp cache is of a finite size, and would become full of incomplete and obsolete entries for computers that are not in use if it was allowed to grow without check. The arp cache is therefore periodically flushed of all entries. This deletes unused entries and frees space in the cache. It also removes any unsuccessful attempts to contact computers which are not currently running.
2. THE INTERNETWORK PROTOCOL (IP)
The IP (Internet Protocol) is a protocol which uses datagrams to communicate over a packet-switched network. The IP protocol operates at the network layer protocol of the OSI reference model and is a part of a suite of protocols known as TCP/IP.
The Internetwork Protocol (IP) provides a best effort network layer service for connecting computers to form a computer network. Each computer is identified by one or more gloablly unique IP addresses. The network layer PDUs are known as either "packets" or "datagrams". Each packet carries the IP address of the sending computer and also the address of the intended recipient or recipients of the packet. Other management information is also carried.
The IP network service transmits datagrams between intermediate nodes using IP routers. The routers themselves are simple, since no information is stored concerning the datagrams which are forwarded on a link. The most complex part of an IP router is concerned with determining the optimum page link to use to reach each destination in a network. This process is known as "routing". Although this process is computationally intensive, it is only performed at periodic intervals.
An IP network normally uses a dynamic routing protocol to find alternate routes whenever a page link becomes unavailable. This provides considerable robustness from the failure of either links or routers, but does not guarentee reliable delivery. Some applications are happy with this basic service and use a simple transport protocol known as the User Datagram Protocol (UDP) to access this best effort service.
Most Internet users need additional functions such as end-to-end error and sequence control to give a reliable service (equivalent to that provided by virtual circuits). This reliability is provided by the Transmission Control Protocol (TCP) which is used end-to-end across the Internet.
In a LAN environment, the protocol is normally carried by Ethernet, but for long distance links, a data page link protocol such as HDLC is usually used.
Other protocols associated with the IP network layer are the Internet Control Message Protocol (ICMP) and the Address Resolution Protocol (arp).
On-going evolution of the Internet Protocol Suite has lead to a definition of a successor protocol to the widely deployed IPv4. The new protocol is IPv6. (The version number "5" had already been used for an experimental protocol, called ST-2, which has not stood the test of time. IPv6 is now widely implemented, and deployed in many networks.
– 2.1 The IP Address
An address is a data structure understood by a network which uniquely identifies the recipient within the network. Addresses in other places than computer networks: Addresses are used by the postal system to allow a postman to find a person's house; to allow a computer to uniquely identify a location in memory.
A unicast/broadcast IP address is a 32 bit value (i.e. four bytes) which is allocated to each system in the Internet. The 32-bgit value uniquely identifies this system, and therefore no two systems may have the same IP address. Some systems have more than one IP address, in which case they may be reached by any of their IP addresses.
Each IP address consists of two parts, the network part (identifying the network number, or LAN collision domain, to which the computer is attached) and the host part (which identifies the host within the local network). This is therefore a flat allocation technique. An administrator of a specific IP network may freely allocate host addresses within their network, without co-ordination with other any other administrators in the Internet. However, they are not allowed to allocate host addresses belonging to a network number which has not been assigned to them. If they require additional addresses, they must apply for a new block of addresses (i.e. a new network number), which will not normally be consecutive with what was previously assigned.
IP addresses are normally written in a format known as "dotted decimal notation". In this format, each byte of the 4 byte address is expressed as a decimal (base 10) number (i.e. 0 to 255). The four decimal numbers are separated by "dots" or "periods" as shown below:
IP address "129.7.1.10" corresponds to a hexadecimal value of 0x8107010A.
The IP network address is identified as the bit-wise logical AND of the 32-bit IP address with another 32-bit quantity, the netmask. All systems with the same network number share the same netmask (sometimes called a "subnet mask"). This has a bit with a logical '1' for each bit that is a part of the network number, and a logical '0' for each bit which is a part of the host number. The netmask may be written in dotted decimal notation, or alternatively as a hexadecimal number:
e.g. a 24-bit network number has a netmask which may be written as 255.255.255.0, this is identical to 0xFFFFF00.
An IP address may be unicast (for a specific end system), network broadcast (for all systems on a LAN) or multicast (for a group of end systems). A network broadcast address sets the destination to the network address, and then fills each position of the host part of the address with a binary '1'. The special value '0.0.0.0' is reserved for an unknown address. This is seldom used as a packet address, and is not normally valid.
Hence, the IP address 129.7.1.10 with a netmask of 255.255.255.0 indicates the network number is 129.7.1.0.
A 24 bit network number leaves a host part of 8 bits. That is a network with space for 254 hosts. (Remember the host number "0" is reserved for the network itself, and the all one's host address is reserved for use as the network broadcast address). Sometimes the netmask is represented by writing the IP address followed by as a slash ('/') with the number of bits used to form the network number. The above netmask can therefore also be represented as "/24". Here are a few more examples