Address resolution protocol

Hosts on a LAN must reach their local gateway address, else no packets will be forwarded beyond the router on this LAN. Once a host receives a lease from DHCP server, it will also receive DNS addresses and a gateway. But how does the host know the MAC address of the gateway in order to send the frames to it ?

Address resolution protocol, ARP will resolve a destination IP address to a MAC by broadcasting a “WHICH MAC HAS THIS IP ?” message on the LAN. All hosts on the LAN receive this broadcast, but only the the gateway will respond with a MAC address. Other hosts will drop the broadcast as they are not assigned that address.

  • ARP requests

ARP process

In following Demo we validate the ARP process and messages using Wireshark capture.

  1. PC sends an ARP request for 10.1.1.1, with its own MAC address and IP as source. Target is IP 10.1.1.1, but MAC address is obviously unknown.
  2. Router responds to host ARP request to destination MAC and IP of the HOST, and its MAC address as a sender MAC.

At the end of this process, the PC host knows that 10.1.1.1 has MAC fa16.3ea7.80dc, and data can be forwarded from host to router.

  • ARP requests and replies
  • ARP replies capture
  • ARP requests capture

Gratuitous ARP

Hosts will send a gratuitous ARP, stating its own IP and MAC address. This happen without any requests being received. One of the reasons is for a host to inform other hosts on the same LAN in case a MAC address has been changed.

  • Gratuitous wireshark capture