So you can see in the Ethernet header there is a field called type field
Right here
the value of the type field is specified is 8 0 6 and
8 0 6 is
identifier of the ARP protocol
So 8 0 6 is the standard value which identifies that the protocol is ARP protocol
Since the Ethernet header's type field contains 8 0 6 it means that the next protocol which is running
Above the data link layer in the tcp/ip stack is the ARP protocol
right
So after the type field the Ethernet header carries the payload
Now because the value of the type field is 8 0 6 it means that this payload
contains ARP related information
now as we know that ARP protocol comprises of two types of messages the ARP broadcast request message and
ARP reply message
so in this info part
The ARP message could be ARP request message or ARP reply message
The value 8 0 6 only says that the payload contains ARP message
It do not say whether that message is ARP request message or ARP reply message
So to know whether the type of ARP message is ARP request message or ARP reply message in
This payload, we inspect the first byte
So if the value of the first byte is 1 it means the payload
represents the ARP request message and
if
This value is 2 it means that the payload represents the ARP reply message. So in this case
The first byte is 1 it means that this is ARP broadcast
request message
So the payload represents ARP broadcast request message
Now if you see the contents of the ARP broadcast request message it has the source MAC address that is the MAC address of
The machine which generated ARP broadcast message
so in this case the source MAC address is ME that is this value and
the IP address of the source machine
That is 12.1.1.3. So it is the IP address of the interface out of which ARP broadcast
Message was launched by the source machine
So you can see that the ARP broadcast request message was emitted out of interface IFE
Which has the IP address 12.1.1.3 therefore source IP address
Will be 12.1.1.3 and the source MAC address will be the MAC address of that particular interface
right
And
the destination MAC address in the ARP broadcast message is a question mark because
this is the value which the Machine E is trying to find out and
the destination IP address
Is
12.1.1.2 that is this value for which the Machine E is trying to find the
MAC address
Right, so these are the contents of ARP broadcast request message
Also, I would like to
Clarify one more thing when the machine E decides to launch ARP broadcast message
How machine E decides whether it has to launch the ARP broadcast request message out of interface
IFE or out of interface IFE 1
right so for that
Machine E checks that for which IP address it is trying to resolve the ARP
So in this case, it is trying to resolve the ARP for IP address 12.1.1.2
Now machine E will check that
Which local interface is configured with the IP address such that
This IP address falls in the subnet of that particular interface
so in this example
Machine E has interface IFE which is configured with the IP address 12.1.1.
3/24 so clearly this IP address for which ARP is being resolved falls in the subnet
12.1.1.0/24
which is configured on interface IFE and therefore machine E
launches the ARP broadcast request out of interface IFE and not IFE 1
So this is one important concept here that how the Machine decides out of which interface it has to launch
the ARP broadcast request message
So going forward how E would know these MAC address so let us resume with the steps where we have left
So in step seven ARP request packet is received by all the interface connected to the wire so
Machine E launched ARP broadcast request message and this ARP broadcast request message
Will be received by all the machines which are connected to the wire
Right, so the data link layer of none of the machine
Which receives this ARP request packet
Discards the ARP request packet because destination MAC address is equal to the broadcast address
so when this condition happens then data link layer of none of the receiving machines discards the packet that
Is data link layer accepts the packet
So all receiving machines now chops off the Ethernet header and
Handover the next header in the packet, which is the ARP header
To the ARP protocol so data link layer hands over the frame to the next layer in the tcp/ip stack
Which is the ARP protocol
ARP protocol running on top of data link layer sees the destination IP address in the ARP packet
Now
ARP protocol checks that if destination IP address is equal to the IP address of the receiving interface
machine
That is the receiving machine sends back ARP reply else
discards the packet
So in this example
The condition that is specified in step 11 is true only for machine D
The ARP protocol for the router as well as for the Machine F discards the packet
Because
destination IP address that is specified in the ARP request
Message header is not equal to IP address of the receiving interface
So the condition of the step 11 is true only in case of machine D
So it is the machine D which replies back with the ARP reply
So what are the contents of the ARP reply message?
The ARP reply will have the source MAC address, which is MD
So for the ARP reply message D is the source machine
so source MAC address will be MD and
Destination MAC address will be ME
source IP address will be 12.1.1.2
That is this IP address because ARP reply will be sent back
from the same interface from which ARP broadcast request message was received and
the destination IP address will be 12.1.1.3 and
The type of the message will be ARP reply
So ARP reply is placed on the wire by the Machine D and is received by all the interfaces corrected to the wire again
Right
So if you say let us discuss the ARP reply if the Machine D launches the ARP reply
Message it will again be received by all the interfaces which are connected to the wire
So all the machines receives the packet because they are connected to the same wire. It doesn't matter
What is the type of packet
So all receiving machines discards the packet
Because destination MAC address in the ethernet header of the packet is not equal to the receiving interface MAC address
right
so remember here all receiving machines means the machines which are connected to the wire except the Machine E
ARP reply message is processed by E only because the destination MAC address in the ethernet header is equal to ME
So when the machine E process the ARP reply message it will fill its ARP table with the information
This information is actually wrong
it will fill its ARP table with the IP address 12.1.1.2 and the MAC address is
MD and outgoing interface is IFE
So this is so machine E will fill its ARP cache with this information so
Machine E will note that
to reach a neighbor 12.1.1.2
The MAC address of the neighbor is MD and the outgoing interface is IEF
Sorry outgoing interfaces I F E
So remember all the machines which are connected to the same wire are actually neighbors of each other
they are considered as neighbors of each other because they are connected to each other directly by the same wire and
ARP table entry contains the IP address to MAC address mapping of neighbor interfaces
So this is how ARP is resolved by the Machine E for neighbor D
So going forward
this slide shows the contents of the ARP reply message here because the first byte value is 2 it means
that the payload part in the ethernet header is actually the ARP reply message and
In this ARP reply message
You have the source MAC address field, which is the MAC address of the Machine D. And
The source IP address field which is 12.1.1.2
Right and the destination MAC address
will be ME that is E
because machine D is replying back to machine E
therefore the destination MAC address will be the MAC address of Machine E and
destination IP address will be the
IP address of the Machine E
Right. So here the reply-er becomes the source and the machine which actually generated the ARP broadcast message
becomes the
destination
So one thing to note here is that in the Ethernet header in the ARP reply message
the source MAC
field is the MAC address of
the ARP reply-er, which is machine D and the destination MAC address is the
MAC address of the machine E which was the generator of ARP broadcast message
that is MAC address of the machine E
So that is the reason because we have a destination MAC address as a MAC address of some specific machine
Therefore ARP reply messages are unicast messages on data link layer
Right
Unicast means they are directed towards a particular machine which is connected to the wire
So going forward
so in step 6 when E receives the ARP reply message, the E
Machine E will updates its ARP table with the following entry
So it will update its ARP table with the IP address 12.1.1.2 which is the IP address of the neighbor
With the MAC address of the neighbor and the outgoing interface will be IFE
Right. So remember that the ARP table is always updated using source MAC and source IP address fields
in the ARP reply message
Not ARP request message only ARP reply message
so in the previous slide you can see
that the source MAC and the source IP addresses which are specified in the ARP reply message are
these fields and using these fields when the machine E
receives ARP reply message the machine E uses these fields to populate its ARP
table
Right
So E now knows that what it was looking for
That is these MAC address
So E now inserts D's MAC address in the Ethernet header. It was preparing before and
place it on the wire when
The Machine E is ready after cooking up the packet
So that
particular packet when placed on the wire is received by all the interfaces connected to the wire, all
Discards the packet but machine D accepts the packet and we have already discussed that this is called thrashing
So the packet which is placed by the machine E after resolving
the ARP is the packet which contains source MAC address as the MAC address of
the machine E and the destination MAC address as the MAC address of the
Machine D
So data from E has been successfully transmitted to D
right
So when machine E wants to send a data to the Machine D
Machine E has to resolve the ARP first
Only after resolving the ARP, actual data
communication between the Machine E and machine D
will happen
So points to note here are these
Inquiring machine inquiring machine means the machine which wants to know the MAC address for a certain IP address
That is the machine which is launching the ARP broadcast request message
So inquiring machine populates its ARP table using ARP reply message only
Right!!
ARP request message is a broadcast message
Why because the destination MAC address in the Ethernet header is the broadcast address
Whereas ARP reply message is a unicast message
why because the destination MAC address in the Ethernet header of ARP reply message is actually the MAC address of
the broadcast request generator
So ARP messages never crosses L3 router boundary and confined within a subnet
So that we have already discussed that
Whatever be the type of message whether it is ARP broadcast message or ARP reply message
It will never cross the l3 router boundary that is that message has nothing to do on this side of the router
and
ARP works on the layer 2 only and
Number of ARP entries is equal to the number of devices connected to the wire
Right. So in this case machine E if machine E wants to carry out communication with the machine D or machine F
or the router itself
Then the machine E will have to resolve the ARP for machine D, for Machine F as well as for the router also
so for this topology
The number of ARP entries which each machine is expected to have is 3 because
Every machine which is connected to this wire has three neighbors
So finally you are advised to read more about the ARP online
you can just google it and you can read more about the ARP protocol and
You should have at least one glance at the exact message formats
We have given a clear idea of how ARP works
So remembering exact message format is not required as long as you can explain the protocol functioning and main fields in the message
right, so don't try to mug up the
message formats
Only the main fields which are required
To explain the functioning of the protocol It's more than enough that you remember only those fields
Right, so it is not true only for ARP header, but for any protocol
For example IP header has so many fields
But most of the time you need to remember only three or four fields in order to explain the functionality of the IP protocol