Ethernet encapsulation: ARP
There was a brief discussion above about what IP packets looked like
on an Ethernet. The discussion showed the Ethernet header and
checksum. However it left one hole: It didn't say how to figure out
what Ethernet address to use when you want to talk to a given Internet
address. In fact, there is a separate protocol for this, called ARP
(address resolution protocol). Note by the way that ARP is not an
IP protocol. That is, the ARP packets do not have IP headers.
Suppose you are on system 220.127.116.11 and you want to connect to
system 18.104.22.168. Your system will first verify that 22.214.171.124 is on
the same network, so it can talk directly via Ethernet. Then it will
look up 126.96.36.199 in its ARP table, to see if it already knows the
Ethernet address. If so, it will stick on an Ethernet header, and
send the packet. But suppose this system is not in the ARP table.
There is no way to send the packet, because you need the Ethernet
address. So it uses the ARP protocol to send an ARP request.
Essentially an ARP request says I need the Ethernet address for
188.8.131.52. Every system listens to ARP requests. When a system sees
an ARP request for itself, it is required to respond. So 184.108.40.206
will see the request, and will respond with an ARP reply saying in
effect 220.127.116.11 is 8:0:20:1:56:34. (Recall that Ethernet addresses
are 48 bits. This is 6 octets. Ethernet addresses are conventionally
shown in hex, using the punctuation shown.) Your system will save
this information in its ARP table, so future packets will go directly.
Most systems treat the ARP table as a cache, and clear entries in it
if they have not been used in a certain period of time.
Note by the way that ARP requests must be sent as broadcasts. There
is no way that an ARP request can be sent to the right system. After
all, the whole reason for sending an ARP request is that you don't
know the Ethernet address. So an Ethernet address of all ones is
used, i.e. ff:ff:ff:ff:ff:ff. By convention, every machine on the
Ethernet is required to pay attention to packets with this as an
address. So every system sees every ARP requests. They all look to
see whether the request is for their own address. If so, they
respond. If not, they could just ignore it. (Some hosts will use ARP
requests to update their knowledge about other hosts on the network,
even if the request isn't for them.) Note that packets whose IP
address indicates broadcast (e.g. 255.255.255.255 or 18.104.22.168) are
also sent with an Ethernet address that is all ones.