Use Wireshark to capture packets and analyze the working principle of ARP protocol

1.What is ARP protocol

ARP Protocol (Address Resolution Protocol), the Address Resolution Protocol, is used to describe targets in EthernetIP addresses and target hostMAC address are mapped accordingly.

ARP is only used for the IPv4 protocol, IPv6< /span>Use Neighbor Discovery Protocol**(NDP)** instead.

Switches, routers, and hosts all have an ARP cache table. What is recorded in this table is the mapping relationship between IP and host MAC.

For Huawei switches,ARP entriesThe default aging time is20 minutes, this value can be modified.

2.How ARP works

As shown below, the hostPC1 sends an IP data packet to another hostPC2< /span> and convert it Map to the corresponding physical address, and then submit the physical address to the data link layer. IP protocol can receive the logical address from ARP protocol, so the mapping of the logical address to the physical address needs to be completed. The physical (MAC) address must be encapsulated into frames to pass through the physical network. This means that the sender must have the receiver's IP addresses address. Howeverlogical (IP) , it needs to know the receiver's


Previously, here we arePC1Transfer one piecePingReachedPC2:

1)PC1 will check its own ARP cache table before sending data , if there is MAC information corresponding to the IP address, it will be directly encapsulated into the frame and sent. If not, it will be obtained through ARP.

2)PC1 will send ARP Request message To request to obtain the MAC address ofPC2. Since there is no destination in the frame, it cannot be transmitted, so the destination address in the message is full a>. FMAC地址ARPMAC


3)ARP RequestThe destination MAC address isFF-FF-FF-FF-FF- FF (broadcast data frame), so after receiving it, the switch will directly flood (broadcast) the frame operation, and learn the MAC address and port number of the IP to the switch's ownMAC cache table.

4) After all hosts receive the ARP Request message, they will check the frame's Whether the destination IP address matches its own IP address? If not, it will be discarded directly. PC2 finds that it matches its own IP address. If the address matches, PC1's IP and MAC address information will be recorded into its own ARP cache table, and thenPC2 will be sent message to respond. ARP Reply


5) After receiving the unicast data frame, the switch will forward the frame and learn the MAC address and port number of PC2 into its own MAC cache table.

6)PC1ReceivedPC2 a>ARP Reply After the message, it will check whether the destination IP and its own IP address fields are the same. If they match, the source IP address and MAC address of the response message will be learned to itself. in the ARP cache table, and then the information can be transmitted for communication.

3.Which layer does the ARP protocol work on?


arp distributionTCP/IP model中文庎IP layer (网络层). 链路层中文于OSI model,located

The arp protocol is a protocol belonging to thelink layer.

Guess you like