print

Tip of the Month

November 2000

The Six ARP Types

Did you know that there are six variations of the Address Resolution Protocol (ARP)? Understanding the different types can be very useful when troubleshooting address resolution problems on your network. ARP is encapsulated directly inside a frame; i.e. it does not run over IP or any other higher layer protocol.

Classic ARP - This is the one that you're probably most familiar with. It is used when a node knows the IP address of another device on it's subnet, but doesn't know the device's MAC address. For example, a workstation needs the MAC (physical) address of its default gateway (router) and sends an ARP broadcast packet containing the default gateways IP address as the destination protocol address. The gateway responds (hopefully), returning its MAC address.

Gratuitous ARP - Ah yes, those "gratuitous" or unsolicited ARPs sent on a periodic basis by nodes to let other nodes know that they are still there. This helps prevent the other node's ARP cache from aging out the entry of the gratuitous sender. You can tell if it's a gratuitous ARP by looking inside the packet and seeing if both the source protocol address and destination protocol address are set to the node's IP address.

DHCP ARP - Relatively "new" (RFC 2131), this is the ARP you SHOULD see sent by a workstation after it obtains an IP address from a DHCP server. The workstation double checks to see if any node (at least within it's DLC broadcast domain) already has the IP address. You can discern this ARP packet type by looking at it with your protocol analyzer and seeing if the workstation sets the source protocol address to 0.0.0.0 and the destination protocol address to it's own IP address This prevents other listing devices from updating their ARP cache just in case a different node already has it. Unfortunately many platforms, including all Windows versions through Windows 2000, send a Gratuitous ARP after DHCP, which could update listening nodes with the wrong MAC address in the event of a duplicate IP address.

Inverse ARP - The opposite of ARP, allows a node to find an IP address associated with a known MAC address. You usually won't see too many of these in a LAN, but more so in a "WAN" that connects two or more LANs. For example, in Frame Relay, IARP is one way to map data link circuit identifiers (DLCI)-to-IP.

Reverse ARP - Used primarily by diskless workstations. In this case, the sent ARP packet will contains the workstation's MAC address in both the sender and recipient hardware address fields. In this case, there must be an RARP server to return an IP address to the workstation. Because RARP can not return other critical IP information such as the subnet mask or default gateway, we rarely see RARP used anymore. Diskless workstations will now use BOOTP or DHCP.

UnARP - Still experimental (see RFC 1868), but a technique to immediately age-out listening ARP caches when a node removes itself from the network. The packet (sent as a response packet, not a request packet) will contain the sender's IP address but have the source and destination MAC addresses zeroed out.