INTRODUCTION TO ARP:
* ARP is used to find the MAC address of the device for which we already know the IP address.
* The address resolution protocol (arp) is a protocol used by the IP, specifically IPv4, to map IP network addresses to the hardware addresses used by a data link protocol.
* The protocol operates on the Datalink layer (L2) but carries L3 information (IP addresses)
* There are four types of arp messages that may be sent by the arp protocol. These are identified by four values in the "operation" field of an arp message. The types of message are:
1. ARP request
2. ARP reply
3. RARP request
4. RARP reply
* The format of an arp message is shown below:
*
ARP Cache: * To reduce the number of address resolution requests, a client normally caches resolved addresses for a (short) period of time.
* The arp cache is of a finite size, and would become full of incomplete and obsolete entries for computers that are not in use if it was allowed to grow without check.
* The arp cache is therefore periodically flushed of all entries.
* This deletes unused entries and frees space in the cache.
* It also removes any unsuccessful attempts to contact computers which are not currently running.
* The arp request message ("who is X.X.X.X tell Y.Y.Y.Y", where X.X.X.X and Y.Y.Y.Y are IP addresses) is sent using the Ethernet broadcast address, and an Ethernet protocol type of value 0x806. Since it is broadcast, it is received by all systems in the same collision domain (LAN). This is ensures that is the target of the query is connected to the network, it will receive a copy of the query. Only this system responds. The other systems discard the packet silently.
GRATUITOUS ARP:
* Gratuitous ARP is used when a node (end system) has selected an IP address and then wishes to defend its chosen address on the local area network (i.e. to check no other node is using the same IP address). It can also be used to force a common view of the node's IP address (e.g. after the IP address has changed).
* Use of this is common when an interface is first configured, as the node attempts to clear out any stale caches that might be present on other hosts. The node simply sends an arp request for itself.
STATIC ARP:
* We can manually map an Ip address to a specific IP address.
* In switch (conf)#arp <ip address> <mac address> ARPA
* Then, we can see in ARP table using #show arp
* Note: if we don’t see the mapping, it is because the switch thinks the Ip address is in different subnet. So, we can use #ip address <ip address>/24 and then try the above show command
PROXY ARP:
http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html
* Proxy ARP is the technique in which one host, usually a router, answers ARP requests intended for another machine.
* Proxy ARP is the name given when a node responds to an arp request on behalf of another node. This is commonly used to redirect traffic sent to one IP address to another system.
* Proxy ARP works when the hosts are not configured with a default gateway.
* Thus, if A has to send packet to another Ip address on a different network (or different subnet also)
REVERSE ARP:
* Reverse ARP (RARP) as defined by RFC 903 works the same way as the Address Resolution Protocol (ARP), except that the RARP request packet requests an IP address instead of a media access control (MAC) address.
* RARP often is used by diskless workstations because this type of device has no way to store IP addresses to use when they boot. The only address that is known is the MAC address because it is burned in to the hardware.
* RARP requires a RARP server on the same network segment as the device interface. The figure below illustrates how RARP works.
* Because of the limitations with RARP, most businesses use Dynamic Host Configuration Protocol (DHCP) to assign IP addresses dynamically. DHCP is cost-effective and requires less maintenance than RARP. The most important limitations with RARP are as follows:
* Because RARP uses hardware addresses, if the internetwork is large with many physical networks, a RARP server must be on every segment with an additional server for redundancy. Maintaining two servers for every segment is costly.
* Each server must be configured with a table of static mappings between the hardware addresses and the IP addresses. Maintenance of the IP addresses is difficult.
* RARP only provides IP addresses of the hosts but not subnet masks or default gateways.
UNICAST ARP REQUEST:
* As per RFC 1122: Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the timeout should be on the order of a minute, and typically N is 2.
* This is one of four mechanism to timeout the stale ARP entries.
