| 
| 
| 
|
ARP
|
|
|
|
|
ARP
When sending out an IP packet, how is the destination Ethernet address determined?
ARP (Address Resolution Protocol) is used to translate IP addresses to Ethernet addresses. The translation is done only for outgoing IP packets, because this is when the IP header and the Ethernet header are created.
The translation is performed with a table look-up. The table, called the ARP table, is stored in memory and contains a row for each computer. There is a column for IP address and a column for Ethernet address. When translating an IP address to an Ethernet address, the table is searched for a matching IP address. The following is a simplified ARP table:
------------------------------------ |IP address Ethernet address | ------------------------------------ |223.1.2.1 08-00-39-00-2F-C3| |223.1.2.3 08-00-5A-21-A7-22| |223.1.2.4 08-00-10-99-AC-54| ------------------------------------
TABLE 1. Example ARP Table
The human convention when writing out the 4-byte IP address is each byte in decimal and separating bytes with a period. When writing out the 6-byte Ethernet address, the conventions are each byte in hexadecimal and separating bytes with either a minus sign or a colon.
The ARP table is necessary because the IP address and Ethernet address are selected independently; you can not use an algorithm to translate IP address to Ethernet address. The IP address is selected by the network manager based on the location of the computer on the internet. When the computer is moved to a different part of an internet, its IP address must be changed. The Ethernet address is selected by the manufacturer based on the Ethernet address space licensed by the manufacturer. When the Ethernet hardware interface board changes, the Ethernet address changes.
During normal operation a network application, such as TELNET, sends an application message to TCP, then TCP sends the corresponding TCP message to the IP module. The destination IP address is known by the application, the TCP module, and the IP module. At this point the IP packet has been constructed and is ready to be given to the Ethernet driver, but first the destination Ethernet address must be determined.
The ARP table is used to look-up the destination Ethernet address.
But how does the ARP table get filled in the first place? The answer is that it is filled automatically by ARP on an "as-needed" basis.
Two things happen when the ARP table can not be used to translate an address:
1. An ARP request packet with a broadcast Ethernet address is sent out on the network to every computer.
2. The outgoing IP packet is queued.
Every computer's Ethernet interface receives the broadcast Ethernet frame. Each Ethernet driver examines the Type field in the Ethernet frame and passes the ARP packet to the ARP module. The ARP request packet says "If your IP address matches this target IP address, then please tell me your Ethernet address". An ARP request packet looks something like this:
--------------------------------------- |Sender IP Address 223.1.2.1 | |Sender Enet Address 08-00-39-00-2F-C3| --------------------------------------- |Target IP Address 223.1.2.2 | |Target Enet Address| ---------------------------------------
TABLE 2. Example ARP Request
Each ARP module examines the IP address and if the Target IP address matches its own IP address, it sends a response directly to the source Ethernet address. The ARP response packet says "Yes, that target IP address is mine, let me give you my Ethernet address". An ARP response packet has the sender/target field contents swapped as compared to the request. It looks something like this:
--------------------------------------- |Sender IP Address 223.1.2.2 | |Sender Enet Address 08-00-28-00-38-A9| --------------------------------------- |Target IP Address 223.1.2.1 | |Target Enet Address 08-00-39-00-2F-C3| ---------------------------------------
TABLE 3. Example ARP Response
The response is received by the original sender computer. The Ethernet driver looks at the Type field in the Ethernet frame then passes the ARP packet to the ARP module. The ARP module examines the ARP packet and adds the sender's IP and Ethernet addresses to its ARP table.
The updated table now looks like this:
----------------------------------
|IP address Ethernet address |
----------------------------------
|223.1.2.1 08-00-39-00-2F-C3|
|223.1.2.2 08-00-28-00-38-A9|
|223.1.2.3 08-00-5A-21-A7-22|
|223.1.2.4 08-00-10-99-AC-54|
----------------------------------
TABLE 4. ARP Table after Response
The new translation has now been installed automatically in the table, just milli-seconds after it was needed. As you remember from step 2 above, the outgoing IP packet was queued. Next, the IP address to Ethernet address translation is performed by look-up in the ARP table then the Ethernet frame is transmitted on the Ethernet. Therefore, with the new steps 3, 4, and 5, the scenario for the sender computer is:
1. An ARP request packet with a broadcast Ethernet address is sent out on the network to every computer.
2. The outgoing IP packet is queued.
3. The ARP response arrives with the IP-to-Ethernet address translation for the ARP table.
4. For the queued IP packet, the ARP table is used to translate the IP address to the Ethernet address.
5. The Ethernet frame is transmitted on the Ethernet.
In summary, when the translation is missing from the ARP table, one IP packet is queued. The translation data is quickly filled in with ARP request/response and the queued IP packet is transmitted.
Each computer has a separate ARP table for each of its Ethernet interfaces. If the target computer does not exist, there will be no ARP response and no entry in the ARP table. IP will discard outgoing IP packets sent to that address. The upper layer protocols can't tell the difference between a broken Ethernet and the absence of a computer with the target IP address.
Some implementations of IP and ARP don't queue the IP packet while waiting for the ARP response. Instead the IP packet is discarded and the recovery from the IP packet loss is left to the TCP module or the UDP network application. This recovery is performed by time-out and retransmission. The retransmitted message is successfully sent out onto the network because the first copy of the message has already caused the ARP table to be filled.