Address Resolution Protocol (ARP) for Linux administrators

Address Resolution Protocol (ARP) is one of the major protocol in the TCP/IP suit and the purpose of Address Resolution Protocol (ARP) is to resolve an IP address (32 bit Logical Address) to the physical address (48 bit MAC Address). Network Applications at the Application Layer use IP address to communicate with another device.  But at the Datalink layer, the addressing is MAC address (48 bit Physical Address), and this address is burned into the network card permanently. You can view your network card’s hardware address by typing the command “ifconfig ” at the terminal (Without double quotes).

The purpose of Address Resolution Protocol (ARP) is to find out the MAC address of a device in your Local Area Network (LAN), for the corresponding IP address, which network application is trying to communicate.

ARP is something that simply works. No Linux system configuration is necessary. It’s all part of the ethernet and IP protocol. The following information is just part of the Linux culture of full visibility into what is going on. The arp cache can be manipulated through the terminal , this is demonstrated at the end of this article .

The workflow of the ARP protocol in 9 steps :

Step 1: When a source device want to communicate with another device, source device checks its Address Resolution Protocol (ARP) cache to find if  it already has a resolved MAC address of the destination device. If it is there, it will use that address for communication. To view your Local Address Resolution Protocol (ARP) cache, Open Command Prompt and type command “arp -a” (Without double quotes  ).

Step 2: If ARP resolution is not there in local cache, the source machine will generate an Address Resolution Protocol (ARP) request message, it puts its own data link layer address as the Sender Hardware Address and its own IP address as the Sender Protocol Address. It fills the destination IP address as the Target Protocol Address. The Target Hardware Address will be left blank, since the machine is trying to find that.

Step 3: The source broadcast the Address Resolution Protocol (ARP) request message to the local network.

Step 4: The message is received by each device on the LAN since it is a broadcast. Each device compare the Target Protocol Address (IP Address of the machine to which the source is trying to communicate) with its own Protocol Address (IP Address). Those who do not match will drop the packet without any action.

Step 5: When the targeted device checks the Target Protocol Address, it will find a match and will generate an Address Resolution Protocol (ARP) reply message. It takes the Sender Hardware Address and the Sender Protocol Address fields from the Address Resolution Protocol (ARP) request message and uses these values for the Targeted Hardware Address and Targeted Protocol Address of the reply message.

Step 6: The destination device will update its Address Resolution Protocol (ARP) cache, since it need to contact the sender machine soon.

Step 7: Destination device send the Address Resolution Protocol (ARP) reply message and it will not be a broadcast, but a unicast.

Step 8: The source machine will process the Address Resolution Protocol (ARP) reply from destination, it store the Sender Hardware Address as the layer 2 address of the destination.

Step 9: The source machine will update its Address Resolution Protocol (ARP) cache with the Sender Hardware Address and Sender Protocol Address it received from the Address Resolution Protocol (ARP) reply message.

You have learned Address Resolution Protocol (ARP), Address Resolution Protocol (ARP) Message Format and how Address Resolution Protocol (ARP) operate in a LAN. The following table lists the most important commands used to display  and manualy insert / delete entries in the arp table of a Red hat based distro ( CetnOs ) .

Handling the arp cache via the terminal

arp -a   or       arp -e	View the arp cache table .
arp -s ip-address XX:XX:XX:XX:XX:XX	Insert manualy an entry in the arp cache table .  The “xx” stands for the MAC address
arp  -d   ip-address	Delete manually an entry from the arp cache
ip  neigh  flush  all	Delete manualy all entries from the arp cache

Man pages:

• arp (8) man page – manipulate the system ARP cache
• arpwatch (8) man page – keep track of ethernet/ip address pairings
• arpsnmp (8) man page – keep track of ethernet/ip address pairings. Reads information generated by snmpwalk
• arping (8) man page – send ARP REQUEST to a neighbor host
  Print ARP reply (similar to arp -a): arping 192.168.10.99
• ip (8) man page – show / manipulate routing, devices, policy routing and tunnels
  View ARP table: ip neighbor