ARP address resolution protocol is a very important concept to understand since it can be used as an
attack vector when an endpoint needs to send data on a network.
It needs to have both IP address and MAC address information for its destination the destination IP
address is always known for building IP packets but destination MAC addresses are not known by default.
To encapsulate an IP packet and an Ethernet frame we must have MAC address information to find out what
the MAC address is of a destination.
Arp is used endpoints on broadcast frames onto the LAN with ARB request information.
These broadcasts are seen by all hosts on the same LAN as the source host.
Now our request asks for hosts with the requested IP address to respond with their MAC address.
So if the computer in this diagram wanted to send data to the router it would first now and our requests
saying hey whoever receives this broadcast and has that theater outs turned out $1.10 one then reply
to my R.P. quests with your MAC address.
So once the router gets this broadcast address it would then respond with an ARP reply with its MAC
address information to populate the ARP table entry for the computer so you can see Arp in action.
I'm going to run wireshark in the background with it filter to only capture RPE quests and then I'm
going to try to ping a IP address on my land that I know I don't have an RPG for.
You'll see as soon as they hit this ping the first thing my computer is going to do is send out on our
request for its MAC address.
So you can see that as soon as I hit ping we saw the ARP request go out asking for buffer has IP address
10.0 would a loving not 22 tell my IP address 10.0 down of love and love in your addresses.
And here's what the actual ARP data looks like for the art request it as my source mac address my source
IP address target IP address and of course the target MAC address isn't filled out because that's what
we're trying to figure out.
In our reply here we see that our destination host responded inside the IP address 10.0 it of love not
22.
Is at this MAC address.
So here's the ARP reply with the MAC address that we were looking for so we could finish building are
used or not frame.