By Delana Hallstedt
Okay, so that was two. However, in my defense, I’m only planning on blogging about the first one. I just have to cross my fingers and hope my flagrant use of random letters doesn’t get squashed by an editor : )
Now then, Address Resolution Protocol, aka ARP, is used to map an IP address to a hardware address. ARP is a broadcast protocol that resides at the border between the Internet layer and the Network Access layer. ARP can dynamically map an IP address to a hardware address, such as an Ethernet Media Access Control (MAC) address.
The Internet layer relies on ARP to determine the hardware address associated with a particular IP address. If a Protocol Data Unit’s (PDU’s) destination IP address is in the same network as an interface configured on the host, ARP will determine the hardware address that is associated with that IP address. However, if the PDU’s destination IP address is in a network to which the host is not directly connected, ARP will determine the hardware address associated with the next hop IP address instead of with the destination IP address. Once the appropriate mapping is found, the Internet layer can instruct the Network Access layer to forward the PDU to the corresponding hardware address.
For example, in an Ethernet network, an ARP request uses a destination MAC address of FF:FF:FF:FF:FF:FF and is received by all hosts on the local LAN segment. The request simply states, “Who is IP address x.x.x.x? Tell IP address y.y.y.y.” Because the ARP request uses a hardware broadcast address, the Network Access layer on each receiving host forwards the request to the host’s ARP process. The host with the corresponding IP address will recognize its IP address in the ARP request and will then issue an ARP reply directly to the IP address specified in the ARP request. When the querying host receives the reply, it will record the IP address–to–MAC address mapping in its ARP table for future reference.
Reverse ARP (RARP) is a similar protocol that performs a mapping between a hardware address and an IP address. RARP can be used by a host to dynamically discover an IP address if it has not been configured with a static IP address. RARP has largely been replaced by the Dynamic Host Configuration Protocol (DHCP) because it is more robust and easier to manage.
You can view the ARP table on a Microsoft Windows host by issuing the arp -a command. The following command output displays some sample mappings you might find when you issue this command to display the contents of a host’s ARP cache:
Interface: 18.104.22.168 --- 0x2
Internet Address Physical Address Type
22.214.171.124 00-17-5a-ac-ff-0a dynamic
126.96.36.199 00-19-56-9a-ae-2c dynamic
188.8.131.52 00-11-43-ed-20-f0 dynamic
184.108.40.206 00-0c-29-71-7c-ae dynamic
220.127.116.11 00-19-b9-e1-48-20 dynamic
Similarly, you can issue the show ip arp command to display the ARP table on many Cisco devices.
FTR (for the record), IP and DHCP are technically initialisms, not acronyms, just in case you’re keeping score. Initialisms are spoken one letter at a time. ARP and MAC, on the other hand, are true acronyms because they are pronounced as a word, not the individual letters that make up the abbreviation. Turns out some form of acronym usage has been around since at least the Roman Empire days, the IT industry just made it a whole lot more popular in the 20th century. I didn’t want to leave you hanging, but aren’t you glad I didn’t spend a thousand words trying to tell you all about how the powers that be in the IT industry like to create names for things that are super descriptive of what the thing actually does just so that they can scrunch the name up into a couple of letters that the average Joe Tech needs to be able to logic back out into the full name when he wants to pass a certification test? That’s not confusing. At all. Right?