Address Resolution Protocol
30th September 2017
Overview
Address resolution protocol (ARP) is a method for mapping IPv4 addresses to MAC addresses. There are a few different flavours of ARP that have evolved over the years.
ARP
Regular ARP maps an unknown MAC address to a known IPv4 address and is defined in RFC826.
ARP Operation
Proxy ARP
Proxy ARP is when a device like a router that knows the MAC address of an IPv4 address in another broadcast domain and responds for that host. Proxy ARP is defined in RFC1027.
Proxy ARP Operation
In the below example, the outside host 10.1.1.200
is configured with a /24
so it believes
it is in the same broadcast domain as the inside host on 10.1.1.10
. The outside host will not perform
a route lookup and instead go straigt to an arp request. Since proxy arp is enabled on R1, the router will reply
with its own mac address for 10.1.1.10
.
Reverse ARP
Reverse ARP (RARP) does the opposite of ARP and maps an unknown IPv4 address to a known MAC address. RARP is defined in RFC903.
RARP is replaced by DHCP in modern equipment but may still be around if working with ancient sun/solaris equipment.
RARP Operation
Gratuitous ARP
Gratuitous ARP (GARP) is used to update hosts of a MAC address change. It is used in duplicate address detection, first hop redundancy protocols and also man in the middle attacks to fake an IP to MAC address mapping. Gratuitous ARP is described in the original ARP specification RFC826.
There are two types of gratuitous ARP.
GARP request
Source and destination IP set to the sending host and destination mac is ff:ff:ff:ff:ff:ff.GARP reply
An ARP reply where no request was made. May be a broadcast or unicast.
GARP Reply
Packet Captures
Various ARP PCAPs can be found here.