IT Certification Study Guide share & Training Preparation Ebooks free download
Posts tagged arp
Cisco CCNA:Address Resolution Protocol (ARP)
May 3rd
ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a MAC address.
Address resolution protocol works at the Data Link Layer.It is also used for IP over other LAN technologies, such as Token Ring, FDDI, or IEEE 802.11, and for IP over ATM.
Address resolution is the process to find an address of a computer in a network. For instance, Host B intends to send information to Host A but has not the MAC address of Host A in its ARP cache. Host B sends a broadcast message for all hosts within the broadcast domain to obtain the MAC address associated with the IP address of Host A. All hosts within the broadcast domain receive the ARP request, and Host A responds with its MAC address.
An Ethernet network uses two hardware addresses which identify the source and destination of each frame sent by the Ethernet. The destination address (all 1′s) may also identify a broadcast packet (to be sent to all connected computers). The hardware address is also known as the Medium Access Control (MAC) address, in reference to the standards which define Ethernet. Each computer network interface card is allocated a globally unique 6 byte link address when the factory manufactures the card (stored in a PROM). This is the normal link source address used by an interface. A computer sends all packets which it creates with its own hardware source link address, and receives all packets which match the same hardware address in the destination field or one (or more) pre-selected broadcast/multicast addresses.
The Ethernet address is a link layer address and is dependent on the interface card which is used. IP operates at the network layer and is not concerned with the link addresses of individual nodes which are to be used.The address resolution protocol (arp) is therefore used to translate between the two types of address. The arp client and server processes operate on all computers using IP over Ethernet. The processes are normally implemented as part of the software driver that drives the network interface card.
Four types of arp messages :
1. ARP request
2. ARP reply
3. RARP request
4. RARP reply
The format of an arp message is shown below:
Inverse ARP and Reverse ARP
The Inverse Address Resolution Protocol, also known as Inverse ARP or InARP, is a protocol used for obtaining Layer 3 addresses (e.g., IP addresses) of other nodes from Layer 2 addresses (e.g. the DLCI in Frame Relay networks). It is primarily used in Frame Relay and ATM networks, where Layer 2 addresses of virtual circuits are sometimes obtained from Layer 2 signaling, and the corresponding Layer 3 addresses must be available before these virtual circuits can be used.
ARP translates Layer 3 addresses to Layer 2 addresses, therefore InARP can be viewed as its inverse. In addition, InARP is actually implemented as an extension to ARP. The packet formats are the same; only the operation code and the certain field values differ.
Reverse ARP (RARP), like InARP, also translates Layer 2 addresses to Layer 3 addresses. However, RARP is used to obtain the Layer 3 address of the requesting station itself, while in InARP the requesting station is querying the Layer 3 address of another node. RARP was obsoleted by BOOTP which itself has been superseded by the Dynamic Host Configuration Protocol (DHCP).
ARP Spoofing Attacks
ARP spoofing attacks and ARP cache poisoning can occur because ARP allows a gratuitous reply from a host even if an ARP request was not received. After the attack, all traffic from the device under attack flows through the attacker’s computer and then to the router, switch, or host.
An ARP spoofing attack can target hosts, switches, and routers connected to your Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet.
Understanding DAI and ARP Spoofing Attacks
DAI is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from some man-in-the-middle attacks.
DAI ensures that only valid ARP requests and responses are relayed. The switch performs these activities:
Intercepts all ARP requests and responses on untrusted ports
Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination
Drops invalid ARP packets
DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid.
DAI can validate ARP packets against user-configured ARP access control lists (ACLs) for hosts with statically configured IP addresses.
You can configure DAI to drop ARP packets when the IP addresses in the packets are invalid or when the MAC addresses in the body of the ARP packets do not match the addresses specified in the Ethernet header.
Popularity: 2% [?]
ARP, IARP, RARP & Proxy ARP
Apr 11th
ARP, IARP, RARP, and Proxy ARP?
When I first started studying for my CCNA years ago, one of the things that confused me was ARP. Or rather, what ARP did as opposed to Reverse ARP, Inverse ARP, and Proxy ARP! One book would mention ARP without mentioning the other variations, one would mention RARP but not Proxy ARP, and so on.
I never forgot how confusing this was to me when I started. To help current CCNA candidates with this confusing topic, let’s take a look at each one of these technologies.
ARP – Address Resolution Protocol
You may well know what ARP does from your networking studies or work on a LAN, but to effectively troubleshoot ARP issues on a WAN, you need to take network devices into account that may be separating the workstations in question.
The basic ARP operation is simple enough. We concentrate on IP addressing a great deal in our studies and our jobs, but it’s not enough to have a destination IP address in order to send data; the transmitting device must have a destination MAC address as well.
If the sender doesn’t know the MAC address of the destination, it has to get that address before data can be sent. To obtain the unknown Layer Two address when the Layer Three address is known, the sender transmits an ARP Request. This is a Layer Two broadcast, which has a destination address of ff-ff-ff-ff-ff-ff. Since Ethernet is a broadcast media, every other device on the segment will see it. However, the only device that will answer it is the device with the matching Layer Three address. That device will send an ARP Reply, unicast back to the device that sent the original ARP Request. The sender will then have a MAC address to go with the IP address and can then transmit.
There are several network devices that may be between our two hosts, and for the most part, there is no impact on ARP. Since this is Cisco, though, there’s gotta be an exception! Let’s take a look at how these devices impact ARP.
Repeaters and Hubs are Layer One (Physical Layer) devices, and they have no impact on ARP. A repeater’s job is simply to regenerate a signal to make it stronger, and a hub is simply a multiport repeater. Therefore, neither a repeater nor a hub have impact on ARP.
Switches are Layer Two devices, so you might think they impact ARP’s operation; after all, ARP deals with getting an unknown MAC address to correspond with a known IP address. While that’s certainly true, switches don’t impact ARP for one simple reason: Switches forward broadcasts out every port except the one it was originally received on. The ARP Reply will be unicast to the device requesting it, as with the previous example.
Now here’s the exception — a router. Routers accept broadcasts, but routers will not forward them. For example, consider a PC with the address 20.1.1.1 /16. That host assumes it’s on the same physical segment as the device 20.1.2.200 /16, since their IP addresses are both on the same subnet (20.1.0.0 /16). The problem here is that a router separates the two devices, and the router will not forward the ARP broadcast.
The Cisco router will answer the ARP Request, however, with the MAC address of the router interface the ARP Request was received on. In this case, the router will respond to the ARP Request with its own E1 interface’s MAC address.
When the device at 20.1.1.1 receives this ARP Response, it thinks the MAC address of 20.1.2.200 is 11-11-11-11-11-11. Therefore, the destination IP for traffic destined for the remote host will be 20.1.2.200, but the MAC destination will actually be that of the router’s E1 interface.
Proxy ARP runs by default on a Cisco 2500 router, but it can be turned off at the interface level with the no ip proxy-arp command.
RARP and Inverse ARP
Reverse ARP is a lot simpler! RARP obtains a device’s IP address when it already knows its own MAC address. (If the device doesn’t know it’s own MAC address, you have bigger problems than RARP!) A separate device, a RARP Server, tells the device what its MAC address is in response to the RARP Request. As you can see, RARP and DHCP have a lot in common.
Inverse ARP doesn’t deal with MAC or IP addresses. Inverse ARP dynamically maps local DLCIs to remote IP addresses when you configure Frame Relay. Many organizations prefer to statically create these mappings; you can turn this default behavior off with the interface-level command no frame inverse-arp.
Popularity: 1% [?]
IP/IPv4: Internet Protocol Overview
Mar 21st
Internet Protocol version 4 (IPv4) is the fourth revision in the development of the Internet Protocol (IP) and it is the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet. IPv4 is still by far the most widely deployed Internet Layer protocol. As of 2010, IPv6 deployment is still in its infancy.
IPv4 is described in IETF publication RFC 791 (September 1981), replacing an earlier definition (RFC 760, January 1980).
IPv4 is a connectionless protocol for use on packet-switched Link Layer networks (e.g., Ethernet). It operates on a best effort delivery model, in that it does not guarantee delivery, nor does it assure proper sequencing, or avoid duplicate delivery. These aspects, including data integrity, are addressed by an upper layer transport protocol (e.g., Transmission Control Protocol).
Here is an IPv4 Fractal map that comes from an article on Network World. You can find it here : Click here free download More >
Popularity: 1% [?]
Understanding Private VLANs
Jan 31st
Private VLAN concepts are quite simple, but Cisco’s implemenation and configuration steps are a bit confusing – with all the “mappings” and “associations” stuff. Here comes a short overview of how private VLANs work.
To begin with, let’s look at the concept of VLAN as a broadcast domain. What Private VLANs (PVANs) do, is split the domain into multiple isolated broadcast subdomains. It’s a simple nesting concept – VLANs inside a VLAN. As we know, Ethernet VLANs are not allowed to communicate directly, they need L3 device to forward packets between broadcast domains. The same concept applies to PVLANS – since the subdomains are isolated at level 2, they need to communicate using an upper level (L3 and packet forwarding) entity – such as router. However, there is difference here. Regular VLANs usually correspond to a single IP subnet. When we split VLAN using PVLANs, hosts in different PVLANs still belong to the same IP subnet, but they need to use router (another L3 device) to talk to each other (for example, by means of local Proxy ARP). In turn, router may either permit or forbid communications between sub-VLANs using access-lists.
Why would anyone need Private VLANs? Commonly, this kind of configurations arise in “shared” environments, say ISP co-location, where it’s beneficial to put multiple customers into the same IP subnet, yet provide a good level of isolation between them.
For our sample configuration, we will take VLAN 100 and divide it into two PVLANs – sub-VLANs 101 and 102. Take the regular VLAN and call it primary (VLAN 100 in our example), then divide ports, assigned to this VLAN, by their types: More >
Popularity: 1% [?]
Recent Comments