Understanding ARP (Address Resolution Protocol) basics

The MAC address is how machines on a subnet communicate. When machine A sends packets to another machine on its subnet, it sends it using the MAC address. When sending a packet to a machine on the public Internet, the packet is sent to the MAC address of the router interface that is the default gateway. IP addresses are used to figure out the MAC address to send to using ARP.

ARP stands for Address Resolution Protocol. When you try to ping an IP address on your local network, say 192.168.1.1, your system has to turn the IP address 192.168.1.1 into a MAC address. This involves using ARP to resolve the address, hence its name.

Systems keep an ARP look-up table where they store information about what IP addresses are associated with what MAC addresses. When trying to send a packet to an IP address, the system will first consult this table to see if it already knows the MAC address. If there is a value cached, ARP is not used.

If the IP address is not found in the ARP table, the system will then send a broadcast packet to the network using the ARP protocol to ask “who has 192.168.1.1”. Because it is a broadcast packet, it is sent to a special MAC address ( ff:ff:ff:ff:ff:ff ) that causes all machines on the network to receive it. Any machine with the requested IP address will reply with an ARP packet that says “I am 192.168.1.1”, and this includes the MAC address which can receive packets for that IP.

Now, lets broadcast an ARP reply packet which is not in response to a specific request. [ i.e. purposeful ARP reply without any request ] to understand. For this we can use below command,

 $ arping -A -I wlan0 192.168.0.106 

replace wlan0 as your active interface and 192.168.0.106 as with your active IP address.

This will send “ARP Reply” packets to the broadcast MAC address on wlan0, over and over until you press Control-C. Other machines on the network will update their ARP tables when they see these packets.

In our next post, we will check “Sending ARP request and receiving ARP Reply using C code”

Credit – https://www.tummy.com/articles/networking-basics-how-arp-works/ and http://www.pdbuchan.com/rawsock/rawsock.html