3.2 ARP

ARP (Address Resolution Protocol) Click here to learn the basics!

IMPORTANT

When testing connectivity in Cisco Packet Tracer, the Simple PDU (ICMP packet) test may sometimes fail initially. However, if you run the same test multiple times, it often succeeds. Once the test succeeds, it should remain successful regardless of how many times it is repeated. This behavior occurs because of the ARP (Address Resolution Protocol) process, which resolves the MAC address of the destination device before sending the ICMP packet.

Here’s why:

1. ARP Resolution:

   • Before sending an ICMP packet (e.g., a ping), the source device must know the MAC address of the destination device.
   • The source device sends an ARP request to resolve the destination’s IP address to its MAC address.
   • Once the MAC address is obtained, it is cached in the ARP table for future use.

2. First Attempt Failure:

   • On the first attempt, the ARP request may not have completed successfully, causing the ICMP packet to fail.
   • This can happen due to timing issues or delays in the ARP resolution process.

3. Subsequent Attempts:

   • After the ARP resolution is successful, the MAC address is stored in the ARP table.
   • Subsequent ICMP packets can be sent immediately using the cached MAC address, leading to successful connectivity tests.

4. MAC Address Usage:

   • MAC addresses are used in the Ethernet frame to deliver data within the same LAN (Local Area Network).
   • Since communication within a LAN relies on MAC addresses, ARP resolution is a critical step before any data (including ICMP packets) can be transmitted.

Key Points to Remember

1. ARP is a One-Time Process:

   • ARP resolution happens only once (or until the ARP cache entry expires).
   • After the MAC address is cached, the source device can send ICMP packets without delay.

2. Packet Tracer Behavior:

   • In Packet Tracer, the simulation may not always account for real-world timing delays, which can cause the first ICMP packet to fail.
   • Running the test multiple times ensures that ARP resolution completes successfully.

3. MAC Addresses are Local:

   • MAC addresses are used only within the same LAN. For communication across networks, IP addresses and routing are used.

Example

Example of how ARP (Address Resolution Protocol) works in Cisco Packet Tracer. We’ll create a simple network with two PCs and observe how ARP resolves IP addresses to MAC addresses.

Topology

• Two PCs: PC0 and PC1.
• A single switch: Switch0 (optional, as ARP works in a direct connection as well).

Step 1: Set Up the Network

1. Open Cisco Packet Tracer.
2. Place two PCs (PC0 and PC1) on the workspace.
3. Connect them using a straight-through cable (or connect them via a switch if you want to include a switch in the topology).
4. Assign IP addresses to the PCs:
   • PC0: 192.168.1.10 with subnet mask 255.255.255.0.
   • PC1: 192.168.1.20 with subnet mask 255.255.255.0.

Step 2: Verify Connectivity

1. Open the Command Prompt on PC0.
2. Ping PC1 to test connectivity:

   ping 192.168.1.20

   • The first ping may take a little longer because PC0 needs to resolve the MAC address of PC1 using ARP.
   • Subsequent pings will be faster because the MAC address is now cached in the ARP table.

Step 3: Observe ARP in Action

1. Clear the ARP Cache:

   • On PC0, clear the ARP cache to simulate a fresh start:

     arp -d

   • This ensures that PC0 does not already have the MAC address of PC1 cached.

2. Capture ARP Traffic:

   • Go to Simulation Mode in Packet Tracer.
   • Set the filter to show only ARP and ICMP packets.
   • Start the simulation.

3. Ping PC1 Again:

   • On PC0, ping PC1:

     ping 192.168.1.20

   • Observe the packets in the simulation window.

Step 4: Analyze the ARP Process

1. ARP Request:

   • PC0 sends an ARP broadcast request to all devices on the network, asking, “Who has 192.168.1.20?”
   • The ARP request is encapsulated in an Ethernet frame with:
     • Source MAC: PC0’s MAC address.
     • Destination MAC: FFFF.FFFF.FFFF (broadcast address).

2. ARP Reply:

   • PC1 receives the ARP request and responds with an ARP reply, providing its MAC address.
   • The ARP reply is encapsulated in an Ethernet frame with:
     • Source MAC: PC1’s MAC address.
     • Destination MAC: PC0’s MAC address.

3. Ping (ICMP):

   • Once PC0 has the MAC address of PC1, it sends the ICMP echo request (ping) to PC1.
   • PC1 responds with an ICMP echo reply.

Step 5: Verify the ARP Table

1. On PC0, check the ARP table to see the IP-to-MAC mapping for PC1:

   arp -a

   • You should see an entry like:

     192.168.1.20  00-50-0F-XX-XX-XX  dynamic

     (Replace XX-XX-XX with the actual MAC address of PC1.)

2. On PC1, you can also check its ARP table to see the mapping for PC0:

   arp -a

Step 6: Optional - Use a Switch

If you included a switch in the topology:

• The switch will forward the ARP broadcast request to all connected devices except the sender (PC0).
• The switch will also learn the MAC addresses of PC0 and PC1 and update its MAC address table.

IMPORTANT

• ARP resolves IP addresses to MAC addresses, enabling communication at the data link layer.
• In this example:
  • PC0 sent an ARP request to find the MAC address of PC1.
  • PC1 replied with its MAC address.
  • PC0 used the MAC address to send an ICMP echo request (ping).