Could someone explain: for the Address Resolution Protocol (ARP), is an ARP packet a separate type of Ethernet (Layer 2) frame? Or does it simply get carried in the Ethernet frame payload area, just like an IP packet does? I wasn't quite clear on this after reading the wikipedia page.

Arp is a way of mapping network card MAC addresses to IPV4/6 IPs. It's ancient, and without real security. The lowest levels use the MAC addresses, the higher levels use the IP.

You looking at network theory? Don't worry too much about that one.

Opps, I see my answer is not related to question.

Forget all you know about TCP right now for this next statement.

ARP is just a way to find where a nic card is. Arp knows where the local mac addresses are.

OK, now we know that arp is a way to find a mac address. Right?

Now turn back on your knowledge of tcp/ip.

Arp has two ways to know what to do. One is static and one is dynamic. Most people might use arp -a command. They'd find that mac addresses have an IP address (usually) associated with them and even either an S or D to tell you how it knows it.

Now say you want to go to 8.8.8.8. It isn't local is it? So your system says OK, where is the gateway? 192.168.1.1 might be your gateway but your stupid computer can only find it using the mac address. It sends the request to the mac address of the gateway and then the next system does the same until it gets where it needs to go.

That ought to confuse you or help you.

I understand the purpose of ARP. I am interested more in the details of how it works, in terms of what structures exactly get sent back and forth on the segment. Again: is an ARP "packet" something that just gets dropped on wire as is (as a sort of Ethernet frame type) or does it get dropped into the payload of a normal Ethernet frame (like an IP packet does). If the latter is the case, how then does the receiving host(s) know whether they have received an IP packet or an ARP packet? Does ARP have a protocol number (like ICMP or OSPF?)

About 5 minutes running wireshark would tell you all that and more. It's an ethernet frame with 0x0806 in the type field, as opposed to an IP packet with 0x0800 in the type field.

1 members found this post helpful.

Thanks. Should have thought of that.