ARP

Why it exists

An Ethernet frame is addressed to a MAC address. An application is addressed to an IP address. Nothing connects the two, and there is no directory that maps one to the other, so a host with a packet to send and no matching cache entry cannot construct a frame at all.

ARP fills the gap with the only mechanism available on a shared segment: ask everyone, and let the owner answer. It is nineteen paragraphs long, has no version field, no authentication and no sections, and it has been unchanged since 1982. RFC 826An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet HardwareRFC 826 · INTERNET STANDARD · November 1982

The absence of authentication is not an oversight so much as a period assumption. The protocol was written for a network where everyone attached to the cable was entitled to be there.

Asking the whole segment one question

A host has an IPv4 address and needs the MAC address behind it. There is no directory, so it broadcasts and waits.

How it works

A host with an unresolved address broadcasts a 28-octet request naming the address it wants. Every device on the segment receives it; the one that owns the address replies directly to the asker. RFC 826An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet HardwareRFC 826 · INTERNET STANDARD · November 1982

Both ends learn from the exchange. The request carries the asker’s own address and MAC, so the responder — and anyone else with an existing entry — updates from it. This is why one request populates caches all over the segment. RFC 826An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet HardwareRFC 826 · INTERNET STANDARD · November 1982

Entries are cached with a timeout, typically four hours on a Cisco router and rather less on a host. A stale entry is not an error state; it is simply how long the protocol is willing to believe something without rechecking.

The packet has no IP header. It cannot be routed, cannot cross a subnet boundary and cannot be given a TTL — so ARP is confined to one broadcast domain, and each subnet resolves its own addresses independently. RFC 826An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet HardwareRFC 826 · INTERNET STANDARD · November 1982

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Connectivity to one host is intermittent and alternates in bursts. Both a server and a workstation are reachable at different moments on the same address.

   Narrow it down

   1. Watch the ARP cache entry for that address and see whether the MAC changes.
   2. Check the switch for the MAC address moving between ports.
   3. Look for duplicate-address log messages on hosts and routers on the segment.

   Cause

   Two devices hold the same IP address. Each answers ARP for it, and whichever answered most recently wins every cache on the segment until the other one answers.

   Fix

   Find both devices by MAC address through the switch, and remove the static configuration or fix the overlapping DHCP scope that produced it.

   RFC 5227 §2.4Ongoing Address Conflict Detection and Address DefenseRFC 5227 · PROPOSED STANDARD · July 2008

2. Traffic is being intercepted or blackholed, with correct IP configuration everywhere and no routing change.

   Narrow it down

   1. Compare the MAC address in the gateway cache entry against the router’s real MAC address.
   2. Look for a host sending ARP replies for addresses it does not own.
   3. Check whether dynamic ARP inspection is enabled on access ports.

   Cause

   A host on the segment is sending unsolicited replies. ARP accepts them because it has no way to tell them from solicited ones.

   Fix

   Enable DHCP snooping and dynamic ARP inspection. Static entries protect one host; DAI protects the segment.

3. A host with a clearly wrong subnet mask works fine, and only breaks when a router is replaced or reconfigured.

   Narrow it down

   1. Compare the host mask against the subnet it is on.
   2. Check whether the router answers ARP for addresses outside the local subnet.
   3. Look at how many distinct addresses resolve to the router’s MAC address.

   Cause

   Proxy ARP. The router answers on behalf of anything it can reach, so a host that believes the whole world is local gets the router’s MAC address for everything and works by accident.

   Fix

   Disable proxy ARP and fix the mask. Expect to find several hosts that were relying on it — turning it off on a live segment finds them all at once.

   RFC 1027Using ARP to implement transparent subnet gatewaysRFC 1027 · UNKNOWN · October 1987

4. After a failover, traffic keeps going to the failed device for several minutes and then recovers on its own.

   Narrow it down

   1. Check whether the new active device sent a gratuitous ARP.
   2. Compare the cache timeout on the affected hosts against how long the outage lasted.
   3. Check whether the switch relearned the MAC address on the new port.

   Cause

   Nothing announced the change, so every cache holds the old binding until it ages out. Recovery on its own after a few minutes is the timeout expiring, not anything being fixed.

   Fix

   Ensure the failover mechanism sends a gratuitous ARP. If the virtual MAC moves with the address, the announcement is what updates the switch; if the MAC changes, it is what updates every host.

   RFC 5227 §3Why Are ARP Announcements Performed Using ARP Request Packets andRFC 5227 · PROPOSED STANDARD · July 2008

5. CPU on switches and low-powered devices climbs, and a large flat subnet becomes slow for everyone at once.

   Narrow it down

   1. Measure broadcast rate on the segment.
   2. Check for a scanning host resolving every address in the subnet.
   3. Look for a loop, which multiplies every broadcast.

   Cause

   Every ARP request is a broadcast that every device must process. A /16 of hosts, a scanner, or a forwarding loop each turn that cost into a denial of service without any single device misbehaving.

   Fix

   Split the broadcast domain, rate-limit ARP where the platform supports it, and fix the loop if there is one. Storm control caps the damage but does not address the cause.

Design notes

Enable DHCP snooping and dynamic ARP inspection together on access ports. DAI validates ARP against the snooping binding table, so it needs snooping to be running first — enabling DAI alone drops legitimate traffic on ports whose bindings were never recorded.

A large flat subnet is an ARP problem before it is anything else. Every host broadcasts to resolve, every host processes every broadcast, and the cost is borne by the slowest device on the segment. This is a reason to size subnets, not just to segment for policy.

Proxy ARP hides routing problems rather than solving them. A router answering for addresses it can reach lets a host with a wrong mask or no default gateway work anyway — until the day the router stops, and a fault that was masked for years surfaces as an outage nobody can attribute.

IPv6 replaced ARP with neighbour discovery over ICMPv6 for exactly the reasons above: it lives inside an IP packet, so it has a hop limit, can be secured, and can be filtered by the same tools as everything else.

Misconceptions

“ARP requests are forwarded by routers to find hosts on other subnets.”

An ARP packet has no IP header. It cannot be routed at all. A host reaching a remote subnet resolves its own gateway’s MAC address and sends the frame there; the gateway then resolves the next hop on its own segment. RFC 826An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet HardwareRFC 826 · INTERNET STANDARD · November 1982

“A host only accepts an ARP reply if it sent a matching request.”

Classic ARP has no such correlation. Unsolicited replies are accepted, which is exactly what makes gratuitous ARP useful for failover and what makes spoofing trivial. The two are the same packet used with different intent.

“A gratuitous ARP after failover is what tells hosts where to send traffic.”

Usually it is telling the switch. When the virtual MAC moves with the address — as it does in VRRP — every host cache is already correct, and what was stale was the switch’s forwarding entry for that MAC. RFC 5227 §3Why Are ARP Announcements Performed Using ARP Request Packets andRFC 5227 · PROPOSED STANDARD · July 2008

“Static ARP entries secure a network against spoofing.”

They protect the one host you configured, for the one address you pinned, and they have to be maintained by hand on every host. Dynamic ARP inspection enforces the same thing at the switch, for everyone, from a binding table that is already being maintained.

More walkthroughs

Terms

ARP cache

A host’s table of IPv4-to-MAC bindings, filled from replies and from any request that carries a binding it already holds. Entries age out rather than being revoked, so a wrong entry survives until its timer expires.

Gratuitous ARP

An ARP packet whose sender and target protocol addresses are the same. Nobody asked for it: it announces where an address now lives, which is how failover completes and how spoofing works.

Proxy ARP

A router answering ARP for addresses it can reach but does not own, so a host with a wrong mask or no gateway still works. It hides the misconfiguration rather than fixing it.

Check yourself

• A host needs to reach a server on a different subnet. Whose MAC address does it resolve?

  • The server’s, by sending an ARP request the router forwards
  • Its default gateway’s — a router never forwards ARP
  • The router’s far-side interface
  • None; the switch resolves it
• What does a host do with an ARP reply it never requested?

  • Discards it, because there is no matching request
  • Accepts it and updates the cache — there is no correlation to a request
  • Queues it until a matching request is sent
  • Replies with an error
• After a VRRP failover the virtual MAC moves with the address. What does the gratuitous ARP actually fix?

  • The hosts’ ARP caches
  • The switch’s MAC address table, which still points that MAC at the old port
  • The routing table on the new master
  • Nothing — it is purely informational
• Why does an RFC 5227 ARP probe set the sender protocol address to 0.0.0.0?

  • To make the packet smaller
  • So no receiver caches a binding for an address that may already be taken
  • Because the host has no address configured yet
  • To force a broadcast reply
• A host with a /8 mask on a /24 subnet works normally. What is most likely happening?

  • The switch is correcting the mask
  • Proxy ARP — the router answers for remote addresses, so everything resolves to the router
  • DHCP is overriding the mask
  • The subnet is actually a /8
• What does IPv6 use instead of ARP?

  • ARPv6, with 128-bit address fields
  • Neighbour discovery over ICMPv6, inside an IP packet
  • DHCPv6 exclusively
  • Nothing — IPv6 addresses embed the MAC address
• Why does a very large layer-two segment become a problem even when nothing is wrong?

  • MAC addresses run out
  • Every host processes every ARP request on the segment, and the rate grows with the number of hosts
  • The switch runs out of ports
  • Broadcast frames are rate-limited by the standard
• Must a host have sent a request before it will accept a reply?

  • Yes — an unsolicited reply is discarded
  • No — the protocol has no request state, which is precisely what makes cache poisoning trivial
  • Only if the reply is broadcast
  • Only on IPv6

Related

• VLANs

  Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.

• NDP

  IPv6’s on-link discovery: NS/NA replace ARP, RS/RA find routers and prefixes, and DAD proves an address is unique — a rogue RA is an incident.

• VRRP

  Several routers share a virtual IPv4 or IPv6 address; the highest priority owns it and advertises so backups can take over when silence means the master is gone.