TCP/IP Protocols Overview  |  IP  |  ARP  |  ICMP  |  

Address Resolution Protocol

In an Ethernet or Token Ring network, any station wishing to communicate with another station must know the DLC address of the Network Interface Card that will next receive the data frames. This presents a unique problem to higher layer protocol stacks because they must find some means of relating their Network Layer Addresses to the actual DLC address of the destination NIC. This essay discusses the purpose and functionality of TCP/IP's answer to this problem, Address Resolution Protocol (ARP).


Before we begin the discussion of ARP, an understanding of the difference between DLC (physical) layer addresses and Network Layer Addresses is required. We discussed, in the PREFACE to the Compendium, why we use the term "DLC" (Data Link Control) to refer to the Data Link Layer address; the network interface card address. An entity on a network generally has two addresses, the DLC (Data Link Control) address, refers to the actual burned-in address that is on the individual NIC in a station. DLC addresses are used in the lowest layer of communications and get the message from NIC to NIC. The second address, the Network Layer Address, is usually configured in the protocol stack software, and is used to convey the message from logical endpoint to logical endpoint. Some protocol stacks do not implement a Network Layer. Stations using these protocols address solely at the Data Link Layer.

Ethernet and Token-Ring cards only know how to recognize the DLC addresses, therefore, any communicator on a network must be able to specify the DLC address of both itself and the destination of its messages. Just knowing that you want to talk to IP address is not sufficient.

Furthermore, a message traveling from one logical endpoint to another logical endpoint (station to station, for example) might in reality pass through several different NICs before reaching its destination. In the TCP/IP world, a packet destined for a station that is several gateways away would be addressed to the destination station at the Network Layer, but at the DLC layer would first be addressed to the first gateway, then the second, then the third, etc... until the final gateway addressed the packet to the destination. Here, we see that at the Network Layer the packet is addressed to the logical endpoint of the conversation (the receiving station), but at the DLC layer, the packet had to pass through several NICs, so the DLC address changed.


In order to associate DLC addresses with Network Layer IP Addresses, a TCP/IP station maintains a record called an ARP Cache. The ARP Cache contains mappings of DLC addresses to IP addresses, and when a station wants to send a message to an IP address, it looks for the IP address in its ARP Cache, finds the associated DLC address, and can then properly address the message.

The Address Resolution Protocol comes into play when a station wants to communicate with a certain IP address, but does not have an entry for the IP address in its ARP Cache. A station in this position sends out an ARP frame addressed to the DLC broadcast, so that all IP stations on the network will receive the frame. The ARP broadcast basically says: "If you have the IP address I'm looking for, please respond and tell me your DLC address." If a station on the network has the IP address in the ARP frame, it responds directly to the ARPing station, who adds an entry in its ARP Cache, and then initiates a conversation. If no station responds, then the ARPing station times out.

WildPackets is now Savvius

For the latest information on our products and services please go to our new site at

We are in the process of migrating some of our legacy content to our new site, so is still available. If the content you are looking for has already been migrated we will automatically redirect you.