I present you with a situation.
You want to reach a device within your subnet, and you know it’s IP address.
You try to ping it, but you don’t get an immediate response… What is going on?
Well, ARP.
Address Resolution Protocol is a protocol used by devices to resolve which MAC address is corlated to which IP address.
Today we’ll try to answer the next question.
Why Do we need ARP?… and much more
Well, a piece of the answer lies in the begging of this blog.
We need ARP to find out which MAC address belongs to whcih IP address.
But why?
When we try to send information between two devices that are connected via a network, we do so by using known protocols.
So called rules with which we can communicate.
These rules help us standartize communication methods between different devices and manufacturers.
Most protocols follow the OSI model (will maybe link a future post about the OSI model here)
which is used to visualize the network in a more human/basic manner, and having this model in mind most communication protocols operate.
When we talk about IP and MAC addresses, we need to understand the 2nd and 3rd layers of the OSI model.
(In this blog I will not go into much detail about the different layers, I will use this chance to explain ARP soley)
ARP helps us gather information about the target device so that we’ll be able to communicate with it directly.
And yet, we can communicate with it even without ARP indirectly.
So why do we need ARP?
We need ARP to communicate with target devices in a smooth and more secure manner.
The second Question…
How does ARP work?
ARP works in the following manner.
Let us go back to the beggining of this blog post, you know the IP address of you neighbor at work and you want to send a ping to their station to see if you have connectivity.
You send an ICMP echo request (which is ping) and it takes a few seconds to respond the first time, what is happening in the background?
Every network device has something called an “ARP Table” in which known devices are stored with 3 values
| Internet Address | Physical Address | Type |
| 192.168.10.10 | 11-11-11-11-11-11 | Dynamic |
| 255.255.255.255 | ff-ff-ff-ff-ff-ff | Static |
So, what’s going on in the background?
The next thing is happening.
You try to ping your neighbor, the first ping times out, it does so because your computer does not have the ARP entry for tour neighbor.
Your host sends a broadcast message to all devices within your subnet asking for a specific device that has a specific IP address.
This is why your first ping could fail.
Because you are not sending a unicast message hut a broadcast message and your machine is waiting for a response from your neighbor.
Once you have the ARP entry for that specific host all your pings can go through as unicast messages.
Leave a Reply