Tag Archives: ARP

3.1.a Identify implement and troubleshoot IPv4 addressing and subnetting

3.1.a ARP

from doyle, vol 1 routing tcpip

A device needing to discover the data-link identifier of another device will create an ARP Request packet. This request will contain the IPv4 address of the device in question (the target) and the source IPv4 address and data-link identifier (MAC address) of the device making the request (the
sender). The ARP Request packet is then encapsulated in a frame with the sender’s MAC
address as the source and a broadcast address for the destination.


3.1.a Identify, implement and troubleshoot IPv4 addressing and subnetting

3.1.a [ii] ARP

The Address Resolution Protocol (ARP) was developed to enable communications on an internetwork. Layer 3 devices need ARP to map IP network addresses to MAC hardware addresses so that IP packets can be sent across networks. Before a device sends a datagram to another device, it looks in its ARP cache to see if there is a MAC address and corresponding IP address for the destination device . If there is no entry, the source device sends a broadcast message to every device on the network. Each device compares the IP address to its own . Only the device with the matching IP address replies to the sending device with a packet containing the MAC address for the device (except in the case of “proxy ARP” where a router can reply to ARP request on behalf of another host). The source device adds the destination device MAC address to its ARP table for future reference, creates a data-link header and trailer that encapsulates the packet, and proceeds to transfer the data.

High CPU utilization in the ARP input process occurs if the router has to originate an excessive number of ARP requests. The router uses ARP for all hosts, not just those on the local subnet, and ARP requests are sent out as broadcasts , which causes more CPU utilization on every host in the network. ARP requests for the same IP address are rate-limited to one request every two seconds, so an excessive number of ARP requests would have to originate for different IP addresses. This can happen if an IP route has been configured pointing to a broadcast interface (as opposed to next-hop). A most common example is a default route such as:

ip route Fastethernet0/ 0

In this case, the router generates an ARP request for each IP address that is not reachable through more specific routes, which practically means that the router generates an ARP request for almost every address on the Internet.

Adam, Paul (2014-07-12). All-in-One CCIE V5 Written Exam Guide (Kindle Locations 2252-2253).  . Kindle Edition.





6.3.a Implement and troubleshoot first-hop redundancy protocols

it never stops…


■ Proxy ARP—






■ SNMP—Any further reading of SNMP-related RFCs should begin with RFC 3410, which
provides a great overview of the releases and points to the more important of the vast number
of SNMP-related RFCs.

3.1.a Identify implement and troubleshoot IPv4 addressing and subnetting

3.1.a [ii] ARP

resolving a known l3 address to an unknown l2 address…

i suggest you spend some time here, and with rfc 826… it is not enough to have familiarity…

from: http://www.tcpipguide.com/free/t_ARPMessageFormat.htm

Address resolution using ARP is accomplished through the exchange of messages between the source device seeking to perform the resolution, and the destination device that responds to it. As with other protocols, a special message format is used containing the information required for each step of the resolution process.

ARP messages use a relatively simple format. It includes a field describing the type of message (its operational code or opcode) and information on both layer two and layer three addresses. In order to support addresses that may be of varying length, the format specifies the type of protocol used at both layer two and layer three and the length of addresses used at each of these layers


The ARP message format is designed to accommodate layer two and layer three addresses of various sizes. This diagram shows the most common implementation, which uses 32 bits for the layer three (“Protocol”) addresses, and 48 bits for the layer two hardware addresses. These numbers of course correspond to the address sizes of the Internet Protocol version 4 and IEEE 802 MAC addresses, used by Ethernet.