ARP: Connecting IPs to MACs

The Two-Address Problem

Communication on a network involves addresses at different layers of the OSI model.

• At Layer 3 (the Network Layer), we use logical addresses: IP addresses. These are used to route packets across different networks, from the source all the way to the destination network.
• At Layer 2 (the Data Link Layer), we use physical addresses: MAC addresses. These are used for the final delivery of a frame between devices on the same local network segment (like devices connected to the same switch).

Here's the problem: Your computer might know it wants to send a packet to 192.168.1.10, but the Ethernet switch it's connected to only understands MAC addresses. To create the final Ethernet frame, your computer needs to find the MAC address that corresponds to 192.168.1.10. How does it bridge this gap between a known IP address and an unknown MAC address?

This is precisely the job of the Address Resolution Protocol (ARP).

Let's start with a video that clearly sets up this scenario.

As the video explains, your computer needs to find the MAC address of the next hop on the local network.

• If the final destination is on the same subnet, the next hop is the destination device itself.
• If the final destination is on a remote network, the next hop is the default gateway (the local router interface).

In both cases, ARP is used to find that local MAC address.

The ARP Process: A Conversation on the Network

ARP works through a simple, two-step "question and answer" process that happens on the local network.

1. ARP Request (The Question): The requesting computer sends a special message, an ARP Request, across the entire local network. This is a broadcast. You can think of it as someone shouting in a room: "I'm looking for the device using IP address 192.168.1.10. Can you please tell me your MAC address? By the way, my IP is 192.168.1.5 and my MAC is AA:BB:CC:11:22:33."

2. ARP Reply (The Answer): Every device on the local network receives and hears this broadcast. However, only the one device that actually owns the IP address 192.168.1.10 will formulate a response. All other devices simply ignore the request. The target device sends an ARP Reply directly back to the original requester. This is a unicast message. It's like a person in the room responding directly to the one who asked: "I have IP address 192.168.1.10, and my MAC address is DD:EE:FF:44:55:66."

Once the original computer receives this reply, it now has the mapping it needs and can send its data.

This image perfectly illustrates the two steps:

To see this process animated with a detailed example, please watch the following segment.

The ARP Cache: Remembering Conversations

Broadcasting an ARP request for every single IP packet would be incredibly inefficient and create a lot of unnecessary network noise. To prevent this, operating systems maintain a temporary storage area called the ARP cache (or ARP table).

When a device receives an ARP reply, it stores the IP-to-MAC address mapping in this cache.

• Before sending a packet, a device first checks its ARP cache.
• If a valid entry for the destination IP exists, it uses the cached MAC address and sends the data immediately. No ARP broadcast is needed.
• If no entry exists, then it initiates the ARP request/reply process and adds the new mapping to its cache.

These cache entries are temporary and will be cleared after a set period (a timeout) to ensure the information doesn't become stale if a device's IP or MAC address changes.

Peeking Inside: The ARP Packet Structure

Let's briefly look at the fields inside an ARP message. Understanding this structure is crucial for analyzing network traffic and grasping how ARP-based attacks work.

The key fields to remember are:

• Operation Code: A single field that specifies if the packet is a request (1) or a reply (2).
• Sender Hardware Address (SHA): The MAC address of the sender.
• Sender Protocol Address (SPA): The IP address of the sender.
• Target Hardware Address (THA): The MAC address of the intended receiver. In a request, this is left blank (or set to all zeros) because it's the information being sought.
• Target Protocol Address (TPA): The IP address of the intended receiver.

Security Weakness: ARP Spoofing

Here we arrive at a critical point for your journey into ethical hacking. ARP was designed in an era when networks were considered trusted environments. As such, ARP is a stateless and trusting protocol. It has no mechanism to verify that an ARP reply is legitimate or comes from the actual owner of an IP address.

This opens the door to a common and powerful attack: ARP Spoofing (also known as ARP Cache Poisoning).

An attacker on the local network can exploit this trust by sending forged ARP replies. For example, an attacker can send an ARP reply to your computer that falsely claims: "I have the router's IP address, and my MAC address is [attacker's MAC address]."

Your computer, trusting the reply, will update its ARP cache, creating an entry that maps the router's IP to the attacker's MAC address. From that point on, all the traffic you intend to send to the internet will be sent to the attacker's machine first. This places the attacker in a Man-in-the-Middle (MitM) position, allowing them to intercept, read, or modify all of your outbound traffic.

Understanding this vulnerability is fundamental. Many tools in Kali Linux are designed to either perform or detect ARP spoofing attacks.

Conclusion

In this lesson, we demystified the crucial link between the Network and Data Link layers. You now understand how devices on a local network use ARP to resolve logical IP addresses into physical MAC addresses, a necessary step for any local communication.

Key Takeaways:

• Function: ARP resolves a known Layer 3 IP address to an unknown Layer 2 MAC address on a local network segment.
• Process: It uses a broadcast ARP Request to ask "who has this IP?" and a unicast ARP Reply to provide the corresponding MAC address.
• Efficiency: Devices maintain an ARP cache to store recent mappings, avoiding excessive broadcast traffic.
• Vulnerability: ARP is inherently insecure. Its lack of authentication makes it vulnerable to ARP spoofing, which can enable Man-in-the-Middle attacks.

In our next lesson, we will move one step up the OSI model to Layer 4. Once a packet arrives at the correct machine, how does that machine's operating system know which application (e.g., web browser, email client) to deliver it to? We will answer this by exploring the role of ports in network communication.