S1 / 09 MODULE 9 / ADDRESS RESOLUTION
Find the next-hop address.
Deliver the frame.
IP addresses identify network-layer destinations, but local Ethernet delivery needs a MAC address. Address-resolution protocols connect those two layers.
Why address resolution is necessary
When a host needs to send an IP packet over an Ethernet LAN, it needs the MAC address of the next device on the local link. For a local destination, that is the destination host. For a remote destination, it is the default gateway. IPv4 uses Address Resolution Protocol (ARP); IPv6 uses Neighbor Discovery, which is carried in ICMPv6 messages.
IMG-0651 · IMG-0746Follow an IPv4 ARP exchange
A host checks its ARP cache for a mapping between the target IPv4 address and a MAC address. If no valid entry exists, it sends an ARP Request as a Layer 2 broadcast to FF:FF:FF:FF:FF:FF. Inside the ARP message, the Target Protocol Address is the IPv4 address being queried; the Target Hardware Address is unknown and is set to zero. The request also carries the sender's hardware and protocol addresses. The device that owns the target IPv4 address sends an ARP Reply, normally as a unicast frame to the requester's MAC address. The sender caches the mapping and uses it to build the Ethernet frame.
ARP requests · ARP replies · ARP tableAfter the reply, Host A caches the mapping and can address the next Ethernet frame to Host B's MAC.
Understand IPv6 Neighbor Discovery
IPv6 does not use ARP. Neighbor Discovery Protocol (NDP) uses ICMPv6 messages. A Neighbor Solicitation (NS) asks for information about a neighbor, often using its solicited-node multicast address, and a Neighbor Advertisement (NA) provides the response. Router Solicitation (RS) asks routers to send Router Advertisements (RA), which provide router and configuration information. Redirect messages tell a host that a better first hop exists for a destination. Neighbor Discovery also supports Duplicate Address Detection (DAD).
IMG-0665 · IMG-0674 · IMG-1002Diagnose address-resolution problems
If a host cannot reach a local neighbor, inspect its IPv4 address and subnet mask or IPv6 address and prefix, check the local link, and examine the ARP or neighbor cache. A stale or incorrect mapping can prevent frame delivery even when the IP configuration appears correct. Dynamic ARP entries normally age out; manually configured static entries remain until removed. Host commands such as arp -a display the cache, while Cisco IOS uses show ip arp. Some host platforms support arp -s to add and arp -d to remove entries. ARP spoofing or cache poisoning uses forged replies to create false IP-to-MAC mappings and may redirect traffic through an attacker. Excessive ARP broadcasts also consume local link capacity and host processing time.
ARP cache · Neighbor cache · Network securityRead the fields in an ARP request
Keep the Ethernet header separate from the ARP message. The Ethernet destination MAC for a normal ARP Request is FF:FF:FF:FF:FF:FF. The ARP Target Protocol Address is the IPv4 address being queried. The ARP Target Hardware Address is unknown and is set to zero in the request. The Sender Hardware and Sender Protocol Address fields identify the requester. In a normal ARP Reply, the Ethernet destination is the requester’s unicast MAC address.
ARP request fields · Ethernet broadcast · unicast replyManage caches and recognize security risks
Dynamic ARP mappings are learned and age out; static mappings are manually configured and remain until removed. Check host mappings with a platform-appropriate command such as arp -a; Cisco IOS uses show ip arp. Forged ARP replies can poison caches by associating a legitimate IP address with an attacker’s MAC address, potentially enabling traffic interception. Excessive ARP broadcasts consume local link capacity and device processing resources. ARP poisoning is distinct from switch CAM-table flooding.
Static/dynamic ARP · Cache aging · ARP spoofing · Broadcast overheadCHECK YOUR UNDERSTANDING
Resolve an IP address to a local link address.
Practice ARP broadcasts, neighbor messages, and the role of the default gateway.