ARP Protocol
ARP is used by a host to link an IP address to the corresponding MAC address of another device.
When we want to communicate with a host on the LAN, we usually know its IP address, but not its MAC address — think of the default gateway.
To discover this, ARP sends a broadcast to all stations on the LAN.
(Broadcasts never pass through routers.)
If one of the hosts on the LAN recognizes its own IP address, it replies with an ARP reply, which contains its MAC address.
ARP is a simple protocol.
BECAUSE THE ABOVE SCRIPT USES DUTCH SUBTITLES,
YOU WILL FIND THE ENGLISH TRANSLATION HERE BELOW
0. LENA wants to know JAN's MAC-address
1. LENA broadcasts an ARP-request to JAN's IP
2. all hosts receive and buffer the broadcast
2b next they analyze the ARP request
3. JAN recognizes his IP-address in the ARP-packet
3b JAN now knows LENA's MAC-address
4. JAN prepares a unicast for LENA
5. JAN unicasts to LENA
6. LENA recognizes her MAC and buffers the entire frame
6b the other hosts discard the frame not destined to them
7. LENA analyzes the ARP-packet and adds JAN's MAC-address to her ARP-table
8. Now they can start to communicate
- The Frames
ARP has its own TYPE‑field value: 0806x.
The first packet is a MAC broadcast from the requester to all correspondents on the LAN.
The reply is a unicast, since the MAC address of the requester is included in the ARP request.
- wireshark
ARP-request
In the ARP request, the field we are querying is set to binary zero — in this case, the Target MAC Address.
The MAC address of the sender appears twice in the frame: once in the frame header, and once inside the ARP packet. This is because ARP itself never sees the entire frame; it only sees the payload without the headers.
The opcode for a request is hex 00 01x.
ARP-reply
We see a unicast — the ARP request already contained the MAC address of the requester.
In the ARP reply, all fields for both sender and receiver are filled in.
The opcode for a reply is hex 00 02x.