Questions about this topic? Sign up to ask in the talk tab.

Difference between revisions of "ARP"

From NetSec
Jump to: navigation, search
Line 1: Line 1:
 
<b>A</b>ddress <b>R</b>esolution <b>P</b>rotocol
 
<b>A</b>ddress <b>R</b>esolution <b>P</b>rotocol
  
{{cleanup}}
+
Address Resolution Protocol (ARP) is used to resolve a network layer address to a link layer address, typically resolving a MAC address to an IPv4 address. For example, ARP may resolve the MAC address 01:23:45:67:89:AB to the IPv4 address 192.168.1.1.
  
ARP is used to map [[MAC addresses]] to [[IP address|IP addresses]] on a [[LAN]].  For information on protecting this protocol, see [[static ARP configuration]] for your appropriate [[Operating System|OS]]. For information regarding the auditing or attacking of this protocol, please see [[arp poisoning|ARP poisoning]].
+
To resolve a MAC address to an IP address, ARP uses cached ARP tables containing IP address/MAC address pairs stored locally. For example, lets say Network Device A (NDA) wants to send a packet to Network Device B (NDB) with a MAC address of DE:AD:BE:EF:CA:FE and an IP address of 192.168.1.1, it first needs to resolve DE:AD:BE:EF:CA:FE into 192.168.1.1. To do this, it will first try and lookup the IP address 192.168.1.1 in its ARP table. If it finds the corresponding MAC address it will send the packet to the address it found, and it will (hopefully) reach its target. If it cannot find the corresponding MAC address it will send a broadcast ARP message (with a destination of FF:FF:FF:FF:FF:FF) requesting the IP address 192.168.1.1. NDB will now respond to that message with its MAC address (DE:AD:BE:EF:CA:FE), and will also store the MAC address of NDA in its own ARP cache table. NDA now has the MAC of NDB and can send its message along.
 
+
In linux your ARP table is available by typing :
+
  arp -a
+
 
+
In the console. Example output:
+
 
+
  root@example:~# arp -a
+
  ? (192.168.1.1) at c0:c1:c0:f7:34:a6 [ether] on wlan0
+
 
+
You can delete an entry with '''arp -d''' or add an entry with '''arp -s IP_ADDRESS MAC'''.
+
 
+
More information available in the [[protocols]] section.
+
  
 
[[Category:Protocols]]
 
[[Category:Protocols]]

Revision as of 10:06, 9 September 2011

Address Resolution Protocol

Address Resolution Protocol (ARP) is used to resolve a network layer address to a link layer address, typically resolving a MAC address to an IPv4 address. For example, ARP may resolve the MAC address 01:23:45:67:89:AB to the IPv4 address 192.168.1.1.

To resolve a MAC address to an IP address, ARP uses cached ARP tables containing IP address/MAC address pairs stored locally. For example, lets say Network Device A (NDA) wants to send a packet to Network Device B (NDB) with a MAC address of DE:AD:BE:EF:CA:FE and an IP address of 192.168.1.1, it first needs to resolve DE:AD:BE:EF:CA:FE into 192.168.1.1. To do this, it will first try and lookup the IP address 192.168.1.1 in its ARP table. If it finds the corresponding MAC address it will send the packet to the address it found, and it will (hopefully) reach its target. If it cannot find the corresponding MAC address it will send a broadcast ARP message (with a destination of FF:FF:FF:FF:FF:FF) requesting the IP address 192.168.1.1. NDB will now respond to that message with its MAC address (DE:AD:BE:EF:CA:FE), and will also store the MAC address of NDA in its own ARP cache table. NDA now has the MAC of NDB and can send its message along.