Address Resolution Protocol – ARP

On a network both physical and logical addresses play a role in communication.   The use of logical addresses allows for the communication between more than one single network and also access to devices that may not be directly connected to that network.  Whereas Physical addresses are primarily used to facilitate communication on the single network segment, usually devices which are directly connected to each other using a hub or switch.  However it is important to remember that generally no communication will be possible in practice without both these types of addressing working correctly.  If there is a problem with logical addresses then your traffic between physical devices or from the proxies is likely to be routed off into the ether!

For example if you think about a scenario where you wish to communicate with a single device on your network.  Perhaps this a client PC or server where you need to access some sort of resource perhaps a file that is shared on the device.  When you use a network enabled application it is probably already aware of the IP address of the remote host using some sort of name resolution system like WINS or DNS.  these will merely provide name resolution services although Smart DNS systems like this will provide some additional routing as well.

So in theory all the application needs to do is build the layer  from 3 to 7 of information in the packet which it wants to transmit.  The only specific information that is needed in this stage is the layer 2 data link which contains the MAC (physical) address of the target device.

Why do we need MAC addresses? Well it is used to target the exact device on a physical network, all of which will usually be stored on a device in the network called a switch.  The switch will use a Content Addressable Memory Table (CAM) of every single physical device which is plugged into it’s port. So armed with this information when a request is passed onto the switch it will use this table to identify the device and route the data through the correct port. If the switch is unaware of the MAC address then the device will first check through it’s cache for routing information and if none is present it will have to resolve through external devices. In a practical sense this means that the switch will route the packet out through a default gateway for non identified traffic.

This resolution process that TCP/IP uses to match an IP address to a physical MAC address is known as the Address Resolution Protocol, which is defined in RFC 826. If you use a network analyser or even a simple packet sniffer you’ll be able to easily identify the process as the ARP resolution protocol only uses two packets – an ARP request and response.