Protocol cluster: Ethernet Address Resolution Protocol (ARP) resolution

Introduction

In the previous article, we introduced the frame format of MAC Frame. We know that each Ethernet Frame contains a 48-bit source physical address and destination physical address. The source address is easy to understand, and the address can be read directly from the hardware. But for a network node, how does he know What is the destination physical address of a Frame? In this article, we will learn the ARP protocol to answer this question.

The ARP protocol is mainly used to complete the work of resolving network layer protocol addresses (for example, IP addresses) into physical addresses.

Why is it necessary to convert the address of the network layer protocol to a physical address?

For the physical layer, he can only handle 48-bit physical addresses, and network layer protocols often have protocol addresses defined in their own protocols, and the addresses of these protocols are often different. For example, the length of an IP address is 32 bits, The length of the CHAOS address is 16 bits, and the length of the Xerox PUP address is 8 bits.

Conversely, the existence of the ARP protocol is also necessary. Because if a physical layer wants to support these protocols at the same time, he should not rely on the implementation of these protocols, but define his own address format, and then through a way Convert the address of the network layer protocol to a physical address. This method is the function of the ARP protocol.

To clarify, the following description will tend to describe the network layer protocol as IP.

ARP packet format

The packet structure of the ARP protocol is relatively simple. Let's look directly at an example. Use this example to parse the meaning of each field:

First, we noticed that the possible values ​​of the ar $ op field in the ARP packet are two REQUEST and REPLY. That is to say, the ARP protocol packets can be roughly divided into two types. Let's take a look at them one by one.

REQUEST

The binary data corresponding to this package is:
00 01 08 00 06 04 00 01 dc a3 33 c4 1e 5a c0 a8
01 01 00 00 00 00 00 00 c0 a8 01 65

1. First of all, we see that there are indeed 9 fields in this packet captured by Wireshark, which are completely consistent with the ARP packet structure we gave in the figure above, and correspond one by one.
2. Hardware type: Enternet (1) This field corresponds to ar $ hdr, indicating that the current hardware address type is Ethernet physical address type
3. Protocol type: IPv4 (0x0800) This field corresponds to ar $ pro, indicating that the network layer protocol is the IP protocol, which means that the ARP request packet is to complete the work of resolving an IP address to a physical address.
4. Hardware size: 6 This field corresponds to ar $ hln, indicating the length of the physical address. Here, the unit of 6 is byte, not bit, which needs attention.
5. Protocol size: 4 This field corresponds to ar $ pln and indicates the length of the network layer protocol. Here, the unit of 4 is byte, not bit, which needs attention.
6. Opcode: request (1) This field corresponds to ar $ op and indicates the type of the current ARP packet. Here, this ARP packet is a request packet.
7. Sender MAC Address: This field corresponds to ar $ sha and indicates the physical address of the network node that sent this ARP request packet.
8. Sender IP Address: This field corresponds to ar $ spa, indicating the network layer address of the network node that sent this ARP request packet. Here the network layer protocol should be the IP protocol, so here is an IP address. Naturally, different network layer protocols The ARP protocol implemented, the length and value of this field are different.
9. Target MAC Address: This field corresponds to ar $ tha. It should be that this ARP packet is a request packet and the current network node does not know the physical address of the destination address, so fill in all 0s here to
   occupy the place. 10.Target IP Address: This field corresponds to ar $ tpa, indicating that you want to resolve the IP address to a physical layer address.

to sum up:

1. This ARP request packet wants to resolve the physical address corresponding to the IP address "192.168.1.101"
2. As for ar $hln and ar$The necessity of$h$$l$$n$$and$$a$$r$ pln, we explain: ARP protocol is used to complete the function of resolving the network layer protocol address to the physical layer address, and as we mentioned earlier, the address length of different network layer protocols is Different, so we need these two fields to indicate the length of the address. Only in this way, when the receiver receives this ARP request, it can be parsed correctly.
3. Often, ARP requests are sent in the form of broadcasts. Because when sending this ARP request, the sending node does not know the physical layer address of the receiver.

REPLY

The binary data corresponding to this package is:
00 01 08 00 06 04 00 02 98 fa 9b 17 a8 f8 c0 a8
01 65 dc a3 33 c4 1e 5a c0 a8 01 01

1. After receiving the ARP request, the receiver will compare the network layer address in this ARP request with its own network address. If they are consistent, use their physical layer address to construct an ARP Reply packet to respond to this request.
2. Here, this response no longer needs to be sent in the form of broadcast, because the physical layer address of the sender is included in the received ARP request packet, so the response can be directly sent to the network node.

END!