Address Resolution Protocol

(ARP)

Reading: Chapter 15

Fall 2004 FSU CIS 5930 Internet Protocols 1

 ARP
• Mapping between layer 3 and layer 2
addresses
– IP and MAC addresses
– Given an IP address, what is the corresponding
MAC address?
• Built on top of data-link layer
– Encapsulated and transmitted in data-link layer
data frames
Fall 2004 FSU CIS 5930 Internet Protocols 2
 An example
ARP-Request to MAC FF:FF:FF:FF:FF:FF

MAC
MAC address
address ofof 129.25.10.11
129.25.10.11 ??
1 Reply
Reply to:
to: 49:72:16:08:64:14
49:72:16:08:64:14 (129.25.10.72)
(129.25.10.72)

ARP-Reply to MAC 49:72:16:08:64:14

Reply:t:
Reply:t: 129.25.10.11
129.25.10.11 (49:78:21:21:23:90)
(49:78:21:21:23:90)
Requested
Requested by::
by:: 129.25.10.72
129.25.10.72 (49:72:16:08:64:14)
(49:72:16:08:64:14)

IP: 129.25.10.11
MAC: 49:78:21:21:23:90

Router R

IP: 129.1.11.72
MAC: 10:11:72:AB:02:01

Computer A: Computer B: Computer C:

IP: 129.25.10.72 IP: 129.25.10.97 IP: 129.25.10.81
MAC: 49:72:16:08:64:14 MAC: 49:72:16:08:80:70 MAC: 49:17:92:96:96:96

Fall 2004 FSU CIS 5930 Internet Protocols 3

 ARP packet format
ARP Protocol Data Unit
0 15 31

Hardware
Hardware type
type (layer
(layer 2)
2) Protocol
Protocol type
type (layer
(layer 3)
3)

Address
Address length
length Address
Address length
length
Layer
Operation
Operation
Layer 22 (n)
(n) Layer
Layer 33 (m)
(m)

Source
Source address
address (layer
(layer 2):
2): nn bytes
bytes

Source
Source address
address (layer
(layer 3):
3): m
m bytes
bytes

Destiniation
Destiniation address
address (layer
(layer 2):
2): nn bytes
bytes

Destination
Destination address
address (layer
(layer 3):
3): m
m bytes
bytes

Layer-2
Layer-2 header
header Layer-2
Layer-2 payload
payload Layer-3
Layer-3 trailer
trailer

Fall 2004 FSU CIS 5930 Internet Protocols 4

 ARP packet format: example
ARP-Request to FF:FF:FF:FF:FF:FF ARP-Reply to 49:72:16:08:64:14

0 15 31 0 15 31

0x00
0x00 01
01 (Ethernet)
(Ethernet) 0x80
0x80 00
00 (Internet
(Internet Protocol)
Protocol) 0x00
0x00 01
01 (Ethernet)
(Ethernet) 0x80
0x80 00
00 (Internet
(Internet Protocol)
Protocol)

66 44 0x00
0x00 01
01 (ARP-Request)
(ARP-Request) 66 44 0x00
0x00 02
02 (ARP-Reply)
(ARP-Reply)

49
49 72
72 16
16 08
08 49
49 72
72 16
16 08
08

64
64 14
14 129
129 25
25 64
64 14
14 129
129 25
25

10
10 72
72 00
00 00
00 10
10 72
72 49
49 78
78

00
00 00
00 00
00 00
00 21
21 21
21 23
23 90
90

129
129 25
25 10
10 11
11 129
129 25
25 10
10 11
11

Fall 2004 FSU CIS 5930 Internet Protocols 5

 Receiving ARP packet and replying
• Insert layer 2 address (MAC address)
• Swapping source – destination address fields
• Changing operation field (reply)
• Sending ARP reply

• Source’s IP/MAC pair also inserted into

ARP cache at receiver

Fall 2004 FSU CIS 5930 Internet Protocols 6

 Implementation
• Neighbors
– Computers that can be directly reachable
• Data structures
– arp_tbl
– neigh_table
– neighbor
– neigh_ops
• Functions
– Sending/receiving ARP packets
– Managing ARP data structures

Fall 2004 FSU CIS 5930 Internet Protocols 7

 Data structures
neigh_table
neigh_table
neigh_tables
neigh_tables

arp_tbl
arp_tbl
neigh_table
neigh_table
neigh_table
next
next
family:
family: AF_INET
AF_INET
...
...
constructor
constructor arp_constructor()
...
...
gc_timer
gc_timer neigh_periodic_timer()
...
...
0 neighbour
neighbour neighbour
neighbour
hash_buckets[ NEIGH..]]
hash_buckets[NEIGH..

neighbour
1
next
next
neigh_table
neigh_table net_device
net_device
neigh_parms
neigh_parms
dev
dev
neigh_timer_
timer
timer handler()
neigh_ops
neigh_ops
ha
ha
hh_cache
hh_cache
hh_cache
nud_state
nud_state
next
next output
output
ref_cnt
ref_cnt sk_buff
sk_buff
arp_queue
arp_queue
hh_type:
hh_type: ETH_P_IP
ETH_P_IP ...
...
hh_output
hh_output
hh_data:
hh_data:
00
00 80
80 23
23 32
32 12
12
49
49 72
72 16
16 08
08 64
64 14
14 neighbour
neighbour
NEIGH_-
49
49 78
78 21
21 21
21 23
23 90
90 HASHMASK -1

Fall 2004 FSU CIS 5930 Internet Protocols 8

 neighbor
• dev:
– Pointer to corresponding network device
• timer:
– Pointer to timer to initiate handling routine neigh_timer_handler()
• ha:
– Hardware address of the neighbor
• hh:
– Hardware header
• nud_state:
– State concerning the neighboring computer
• output:
– Function to send data packet to the neighbor
• arp_queue
– Queue of packets waiting to be transmitted
• opts:
– Pointer to a neigh_ops structure

Fall 2004 FSU CIS 5930 Internet Protocols 9

 neigh_table
• family
– Address family, for IP, it is AF_INET
• constructor
– Function to construct a neighbor structure
• gc_timer
– Garbage collection timer
• hash_buckets[NEIGH_HASHMASK+1]
– Hash table for maintaining neighbor info
Fall 2004 FSU CIS 5930 Internet Protocols 10
 neigh_ops
• Different neighbor characteristics
– Generic, direct, hh, and broken
• This structure defines the corresponding
functions for different devices
– destructor, solicit, error_report, output,
connected_output, hh_output, queue_xmit

Fall 2004 FSU CIS 5930 Internet Protocols 11

 States
No sign of life in
Set timer
reachable_time NUD_STALE
NUD_STALE

Receive
packet

receive
NUD_
NUD_ ARP-Reply
REACHABLE NUD_DELAY
NUD_DELAY
REACHABLE

Time
Receive ARP-Reply
out

NUD_
NUD_
INCOMPLETE
INCOMPLETE NUD_PROBE
NUD_PROBE

NUD_NONE
NUD_NONE
arp_constructor: max_probes
initialize an entry, Requests sent,
Send an ARP request No reply

Permanent
Eintrag

NUD_NONE NUD_
NUD_
NUD_NONE
FAILED
FAILED
NOARP-
Device

neigh_create: Garbage Collection

Create an entry
NUD_NOARP
NUD_NOARP completed.
Delete entry

No
No
Emtru
Emtru

Fall 2004 FSU CIS 5930 Internet Protocols 12

 ARP operation
Higher
Higher Layers
Layers

IPv4
IPv4 IPv4
IPv4

ip_queue_xmit

ip_finish_output2

arp.c, neighbour.c
arp.c,
arp.c, neighbour.c
neighbour.c neigh_update
arp_tbl

ARP-Reply
neigh_lookup

neigh_resolve_
output
ARP-Request
arp_rcv arp_send

dev.c
dev.c dev.c
dev.c
ETH_P_ARP

net_rx_action dev_queue_xmit

Fall 2004 FSU CIS 5930 Internet Protocols 13

 Handling ARP PDUs
• arp_rcv()
– Some sanity check
– NF_ARP_IN
– arp_process()
• arp_process()
– Some more sanity check
– For both request/reply
• Update ARP cache (neigh_lookup())
– For request
• arp_send() to send a reply

Fall 2004 FSU CIS 5930 Internet Protocols 14

 Handling ARP packets
• arp_send()
– Allocating socket buffer
– Filling hardware header
– Filling ARP data
– NF_ARP_OUT
– dev_queue_xmit()
• neigh_update()
– Updating neighbor entry state
– Setting up corresponding output function, etc
Fall 2004 FSU CIS 5930 Internet Protocols 15
 Handling unresolved IP packets
• neigh_resolve_output()
– Sending the packet if it is OK (e.g., REACHALBE
state)
– Otherwise (e.g., INCOMPLETE state)
• Storing the pkt in arp_queue queue by neigh_event_send()
• neigh_event_send()
– Checking if the pkt can be sent
– If not, storing IP packet and sending ARP request
(arp_solicit())
• arp_solicit()
– Send ARP request by arp_send()

Fall 2004 FSU CIS 5930 Internet Protocols 16

 Some other neighbor managing
functions
• neigh_connect()
• neigh_suspect()
• neigh_destroy()
• neigh_sync()
• neigh_periodic_timer()
• neigh_timer_handler()

Fall 2004 FSU CIS 5930 Internet Protocols 17