Address Resolution Protocol

(ARP)

Address Resolution Protocol (ARP)




In order for two hosts to communicate, the logical IP address must resolve to the physical
address of the network adapter card. ARP is the protocol that resolves IP addresses to
physical addresses. It is defined in RFC 826. Figure 14 illustrates what information is
contained within an ARP packet.


Figure 14: ARP Packet Contents
Figure 14 shows Sniffer output of ARP request and ARP reply packets.
- - - - - - - - - - - - - - - - Frame 1 - - - - - - - - - - - - - - - - -

SUMMARY Delta T Destination Source Summary
M 1 Broadcast U-B 0F71B1 DLC Ethertype=0806, size=60 bytes
ARP C PA=[11.1.1.70] PRO=IP

DLC: DLC Header -
DLC:
DLC: Frame 1 arrived at 17:30:03.4067; frame size is 60 (003C hex) bytes.
DLC: Destination = BROADCAST FFFFFFFFFFFF, Broadcast
DLC: Source = Station U-B 0F71B1
DLC: Ethertype = 0806 (ARP)
DLC:
ARP: ARP/RARP frame -
ARP:
ARP: Hardware type = 1 (10Mb Ethernet)
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 6 bytes
ARP: Length of protocol address = 4 bytes
ARP: Opcode 1 (ARP request)
ARP: Sender's hardware address = U-B 0F71B1
ARP: Sender's protocol address = [11.1.1.69]
ARP: Target hardware address = 000000000000
ARP: Target protocol address = [11.1.1.70]
ARP:

ADDR HEX ASCII
0000 FF FF FF FF FF FF 00 DD 01 0F 71 B1 08 06 00 01 ..........q.....
0010 08 00 06 04 00 01 00 DD 01 0F 71 B1 0B 01 01 45 ..........q....E
0020 00 00 00 00 00 00 0B 01 01 46 0E 03 01 10 00 01 .........F......
0030 00 00 00 00 00 00 20 46 41 45 46 45 ...... FAEFE

- - - - - - - - - - - - - - - - Frame 2 - - - - - - - - - - - - - - - - -

SUMMARY Delta T Destination Source Summary
2 0.0013 U-B 0F71B1 AT&T 81A7CA DLC Ethertype=0806, size=60 bytes
ARP R PA=[11.1.1.70] HA=08006A81A7CA PRO=IP

DLC: DLC Header -
DLC:
DLC: Frame 2 arrived at 17:30:03.4080; frame size is 60 (003C hex) bytes.
DLC: Destination = Station U-B 0F71B1
DLC: Source = Station AT&T 81A7CA
DLC: Ethertype = 0806 (ARP)
DLC:
ARP: ARP/RARP frame -
ARP:
ARP: Hardware type = 1 (10Mb Ethernet)
ARP: Protocol type = 0800 (IP)
ARP: Length of hardware address = 6 bytes
ARP: Length of protocol address = 4 bytes
ARP: Opcode 2 (ARP reply)
ARP: Sender's hardware address = AT&T 81A7CA
ARP: Sender's protocol address = [11.1.1.70]
ARP: Target hardware address = U-B 0F71B1
ARP: Target protocol address = [11.1.1.69]
ARP:

ADDR HEX ASCII
0000 00 DD 01 0F 71 B1 08 00 6A 81 A7 CA 08 06 00 01 ....q...j.......
0010 08 00 06 04 00 02 08 00 6A 81 A7 CA 0B 01 01 46 ........j......F
0020 00 DD 01 0F 71 B1 0B 01 01 45 0E 03 01 10 00 01 ....q....E......
0030 00 00 00 00 00 00 20 46 41 45 46 45 ...... FAEFE

Figure 14: Sniffer Output of ARP Request and Reply Packets

As shown in frame 1, in order to resolve the physical address, a host will send an ARP request
broadcast on the subnet with the target IP address it is looking for. Frame 2 is the ARP reply
from the host with the target IP address. The host sending the ARP reply has filled in the
physical address requested in the senders hardware address field.

It would be silly to continually send an ARP request broadcast each time a host needs to find the
physical address of another host it accesses often. For this reason, implementations of TCP/IP
include an ARP cache to hold IP address to physical address mappings. Figure 15
outlines the contents of an ARP cache entry as implemented in the LM TCP/IP.



Figure 15: Contents of the ARP Cache


The cache is walked on 5 minute intervals. If the entry is not in use, the timestamp
is incremented. If the entry has not been used for 15 minutes, it is deleted from the cache if the
cache is at maximum capacity. If the cache is at maximum capacity and a new entry comes in,
the first found entry will be yanked and replaced with the new entry.

ARP Parameters in PROTOCOL.INI

The parameter, arptblsize, under the [tcp_xif] section controls the size of the ARP
cache. The default is (tcpconnections*2) + 6. The range is 6 to 512 entries.



Back to Index Page