ARP

ARP

1. ARP Overview

   • Only for IPv4 protocol
   • Used to map IPv4 addresses to MAC addresses
   • Every IP device has a unique MAC address
   • When sending a Layer 2 frame, contains these:
     • Destination MAC address
       • Destination device on same local network segment
       • Destination address of default gateway if host is on another network
     • Source MAC address
       • The MAC address of the Ethernet NIC on the source host
     • To send a packet to a host on same IPv4 local network
       • Host must know IPv4 and MAC address of destination device
         • Device destination IPv4 addresses are either known or resolved by device name. However, MAC addresses must be discovered.
   • Determine destination MAC address when knowing IPv4 address of local device
   • Provides two basic funtions:
     • Resolving IPv4 addresses to MAC addresses
     • Maintaining a table of IPv4 to MAC address mappings

2. ARP Functions

   • Device refers to a table in its memory to find the MAC address that is mapped to the IPv4 address
     • Table stored temporarily in RAM and called ARP table or ARP cache
   • Sending device search in ARP table for IPv4 destination address
     • If destination on same network
       • Search the ARP table for the destination IPv4 address
     • If destination on different network
       • Search the ARP table for the IPv4 address of the default gateway
     • Both cases seach for corresponding IPv4 and MAC addresses

3. Removing Entries from an ARP Table

   • Has a time frame
     • On windows, this frame is between 15 and 45 seconds
   • Can be Manually removed
   • If removed
     • Process of request and recieving must occur again
   • "show ip arp" on router
     • "arp -a" on windows

4. ARP Issues - ARP Broadcasts and ARP Spoofing

   • If multiple devices try to access network services at the same time
     • Reduction in performance
   • ARP can lead to security risk
     • Reply to an ARP request for an IPv4 address that belongs to another device
       • and threat actor replies with own MAC address