ARP

What Is ARP?

 

ARP stands for Address Resolution Protocol. It is a network mechanism that translates IP addresses into corresponding MAC addresses. Therefore, an ARP table must be maintained in the host or Layer 3 network to store the mapping information of IP addresses and MAC addresses. The ARP table is generally categorized into static and dynamic.

 

Is ARP Essential?

 

Yes. To enable communication between hosts or Layer 3 network devices on a LAN, the sender needs to know the destination IP address for sending IP packets. However, before these packets can be transmitted over the physical network, they must be encapsulated with MAC addresses. Consequently, hosts or Layer 3 network devices must maintain an ARP table to store the mappings between IP addresses and MAC addresses.

 

The Different Types of ARP

 

Dynamic ARP

 

Dynamic ARP entries are automatically generated or maintained when ARP packets are sent and received. Static ARP entries may age, update, or overwrite these tables.

 

Dynamic ARP is more appropriate for services and complex networks sensitive to transmission delays.

 

Static ARP

 

Static ARP enables network administrators to establish fixed associations between IP addresses and MAC addresses manually. Static ARP entries are not aged or overwritten by dynamic ARP entries, keeping the system secure.

 

Typically, network devices use ARP to learn and update ARP entries dynamically. However, dynamic ARP entries can be incorrectly updated or aged in an ARP attack on the network, resulting in abnormal communications between authorized users.

 

Static ARP entries are neither aged nor overwritten by dynamic ARP entries, thus ensuring secure communications. If a static ARP entry is configured on a device, the device can only use the specified MAC address to communicate with the peer device. This prevents network attackers from using ARP packets to modify the mapping of IP and MAC addresses, thus guaranteeing secure communication between devices. Static ARP entries are usually configured on gateway devices.

 

Static ARP entries are categorized into short and long entries:

 

Short Static ARP Entries:

The network administrator manually identifies the mapping between IP and MAC addresses without specifying the VLAN and outgoing interface. If the outgoing interface is a Layer 2 Ethernet interface, short static ARP entries cannot be used directly for packet forwarding. The device must first issue an ARP request packet. Suppose the source IP and MAC addresses of the received ARP reply packet match the static ARP entry. In that case, the device will add the VLAN and interface information of the received ARP reply packet to the static ARP entry for subsequent packet forwarding.

 

Long Static ARP Entries:

The network administrator manually establishes the IP address and MAC address mapping and specifies the VLAN and outgoing interface to which the packet is sent. Long static ARP entries are recommended because they can be used directly for packet forwarding.

 

Gratuitous ARP

Gratuitous ARP allows a network device to send an ARP request packet where its IP address is the target IP address.

Main Functions of Gratuitous ARP:

 

1. Detecting IP Address Conflicts: When a device receives an ARP reply to its Gratuitous ARP request, it indicates that another network device uses the same IP address. The device will then periodically send Gratuitous ARP requests until the conflict is resolved.

 

2. Announcing a New MAC Address: If a device's MAC address changes, such as when a network adapter is replaced, the device sends Gratuitous ARP requests to inform other devices on the network about the new MAC address. This ensures that ARP tables are updated with the correct information.

 

3. Informing VRRP Group of Master/backup Switch In a VRRP (Virtual Router Redundancy Protocol) group: when there is a switchover between the master and backup devices, the new master device sends Gratuitous ARP packets to notify the other devices in the group that the switchover has occurred.

 

Proxy ARP

 

Proxy ARP is a technique that allows devices on a given network to answer ARP requests from network addresses that are not on that network.

 

Key Features of Proxy ARP:

 

-Gateway Deployment: It is typically deployed on a network gateway and does not require any changes to the configuration of the network hosts.

 

-Topology Hiding: Proxy ARP conceals the physical network topology, allowing devices on different physical networks to communicate as if they are on the same network.

 

-Selective ARP Table Modification: This modifies only the hosts' ARP tables, leaving the gateway's ARP and routing tables unchanged.

Routed Proxy ARP

Routing Proxy ARP enables devices to communicate on the same logical network segment but on different physical networks.

A host cannot forward data to other network devices without a default gateway address. Routing Proxy ARP addresses this issue.

 

 

For example, Host_1 and Host_2 are on the same logical network segment but connected via different VLANs (VLANIF 10 and VLANIF 20). Host_1 sends an ARP request to find Host_2's MAC address, but because they are on different physical networks, Host_2 does not receive the request. With Routing Proxy ARP enabled, the switch responds to Host_1's ARP request with its MAC address. Host_1 then sends data to the switch, which forwards it to Host_2 as a proxy.

Intra-VLAN Proxy ARP

 

When two users are within the same VLAN, but port isolation is configured, enabling intra-VLAN proxy ARP on the associated VLAN interfaces allows for Layer 3 communication.

 

 

For example, consider Host_1 and Host_2, which are connected to a switch and assigned to VLAN 10. Due to port isolation, they are unable to communicate at Layer 2. However, when intra-VLAN proxy ARP is enabled, the switch can facilitate communication at Layer 3. When the switch receives an ARP request packet with a destination address not matching its own, it searches for an ARP entry corresponding to the interface. If it finds an entry for Host_2, the switch responds with its own MAC address to Host_1 and forwards the packet to Host_2, effectively acting as a proxy.

 

Inter-VLAN Proxy ARP

 

When two hosts are on the same network segment but in different VLANs, enabling inter-VLAN proxy ARP on the relevant VLAN interfaces (such as VLANIF interfaces or sub-interfaces) enables Layer 3 communication.

 

 

For example, Host_1 and Host_2 might be on the same network segment but belong to VLAN 10 and VLAN 20, respectively. Due to being in different VLANs, they cannot communicate at Layer 2. By enabling inter-VLAN proxy ARP on the switch, the hosts can communicate at Layer 3. When the switch receives an ARP request with a destination address not matching its own, it looks up an ARP entry (either dynamically learned or statically configured) for Host_2. If it finds a match, the switch sends its MAC address to Host_1 and forwards the packet to Host_2, functioning as a proxy.