IT Certification Study Guide share & Training Preparation Ebooks free download
Posts tagged Inverse ARP
inverse-arp in frame-relay
May 15th
What does inverse arp in frame-relay?
With inverse-arp something is similiar done like with inverse arp in the IP world. The router is trying to map a Layer 2 adresse to a Layer 3 adress.
With show frame-relay map you can list those mappings.
With inverse arp these are dynamic mappings. It’s also possible to map statically.
frame-relay map [ip] [dlci] broadcast
When you configure point-to-point subinterface inverse arp is not needed, as it is disabled be default on each subinterface.
Popularity: 1% [?]
Cisco CCNA:Address Resolution Protocol (ARP)
May 3rd
ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a MAC address.
Address resolution protocol works at the Data Link Layer.It is also used for IP over other LAN technologies, such as Token Ring, FDDI, or IEEE 802.11, and for IP over ATM.
Address resolution is the process to find an address of a computer in a network. For instance, Host B intends to send information to Host A but has not the MAC address of Host A in its ARP cache. Host B sends a broadcast message for all hosts within the broadcast domain to obtain the MAC address associated with the IP address of Host A. All hosts within the broadcast domain receive the ARP request, and Host A responds with its MAC address.
An Ethernet network uses two hardware addresses which identify the source and destination of each frame sent by the Ethernet. The destination address (all 1′s) may also identify a broadcast packet (to be sent to all connected computers). The hardware address is also known as the Medium Access Control (MAC) address, in reference to the standards which define Ethernet. Each computer network interface card is allocated a globally unique 6 byte link address when the factory manufactures the card (stored in a PROM). This is the normal link source address used by an interface. A computer sends all packets which it creates with its own hardware source link address, and receives all packets which match the same hardware address in the destination field or one (or more) pre-selected broadcast/multicast addresses.
The Ethernet address is a link layer address and is dependent on the interface card which is used. IP operates at the network layer and is not concerned with the link addresses of individual nodes which are to be used.The address resolution protocol (arp) is therefore used to translate between the two types of address. The arp client and server processes operate on all computers using IP over Ethernet. The processes are normally implemented as part of the software driver that drives the network interface card.
Four types of arp messages :
1. ARP request
2. ARP reply
3. RARP request
4. RARP reply
The format of an arp message is shown below:

Inverse ARP and Reverse ARP
The Inverse Address Resolution Protocol, also known as Inverse ARP or InARP, is a protocol used for obtaining Layer 3 addresses (e.g., IP addresses) of other nodes from Layer 2 addresses (e.g. the DLCI in Frame Relay networks). It is primarily used in Frame Relay and ATM networks, where Layer 2 addresses of virtual circuits are sometimes obtained from Layer 2 signaling, and the corresponding Layer 3 addresses must be available before these virtual circuits can be used.
ARP translates Layer 3 addresses to Layer 2 addresses, therefore InARP can be viewed as its inverse. In addition, InARP is actually implemented as an extension to ARP. The packet formats are the same; only the operation code and the certain field values differ.
Reverse ARP (RARP), like InARP, also translates Layer 2 addresses to Layer 3 addresses. However, RARP is used to obtain the Layer 3 address of the requesting station itself, while in InARP the requesting station is querying the Layer 3 address of another node. RARP was obsoleted by BOOTP which itself has been superseded by the Dynamic Host Configuration Protocol (DHCP).
ARP Spoofing Attacks
ARP spoofing attacks and ARP cache poisoning can occur because ARP allows a gratuitous reply from a host even if an ARP request was not received. After the attack, all traffic from the device under attack flows through the attacker’s computer and then to the router, switch, or host.
An ARP spoofing attack can target hosts, switches, and routers connected to your Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet.
Understanding DAI and ARP Spoofing Attacks
DAI is a security feature that validates ARP packets in a network. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from some man-in-the-middle attacks.
DAI ensures that only valid ARP requests and responses are relayed. The switch performs these activities:
Intercepts all ARP requests and responses on untrusted ports
Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination
Drops invalid ARP packets
DAI determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database, the DHCP snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the switch. If the ARP packet is received on a trusted interface, the switch forwards the packet without any checks. On untrusted interfaces, the switch forwards the packet only if it is valid.
DAI can validate ARP packets against user-configured ARP access control lists (ACLs) for hosts with statically configured IP addresses.
You can configure DAI to drop ARP packets when the IP addresses in the packets are invalid or when the MAC addresses in the body of the ARP packets do not match the addresses specified in the Ethernet header.
Popularity: 2% [?]
Frame Relay Overview
Apr 15th
Frame Relay is a connection-oriented Layer 2 protocol that allows several data connections(called virtual circuits) to be multiplexed onto a single physical link. Frame Relay relies on upper-layer protocols for error correction. Frame Relay specifies only the connection between a router and a service provider’s local access switching equipment. The data transmission within the service provider’s Frame Relay cloud is not specified. A connection identifier is used to map packets to outbound ports on the service provider’s switch. When the switch receives a frame, a lookup table is used to map the frame to the correct outbound port. The entire path to the destination is determined before the frame is sent.
Frame Relay Stack
Most Frame Relay functions exist at the lower two layers of the OSI Reference Model. Frame Relay is supported on the same physical serial connections that support point-to-point connections. Cisco routers support the following serial connections: EIA/TIA-232, EIA/TIA-449, V.35, X.21, EIA/TIA-530. Upper-layer information (such as IP data) is encapsulated by Frame Relay and is transmitted over the link.

Frame Relay Terms
# BECN (Backward Explicit Congestion Notification)-A message sent to a source router when a Frame Relay switch recognizes congestion in the network. A BECN message requests a reduced data transmission rate.
# CIR (Committed Information Rate)-The minimum guaranteed data transfer rate agreed to by the Frame Relay switch.
# DLCI (Data Link Connection Identifier)-Identifies the logical circuit between the router and the Frame Relay switch.
# FECN (Forward Explicit Congestion Notification)-A message sent to a destination device when a Frame Relay switch senses congestion in the network.
# Inverse ARP-Routers use Inverse ARP to discover the network address of a device associated with a VC.
# LMI (Local Management Interface)-A signaling standard used to manage the connection between the router and the Frame Relay switch. LMIs track and manage keepalive mechanisms, multicast messages, and status. LMI can be configured (in Cisco IOS 11.2 and later), but routers can autosense LMI types by sending a status request to the Frame Relay switch. The router configures itself to match the LMI type response. The three types of LMIs supported by Cisco Frame Relay switches are Cisco (developed by Cisco, StrataCom, Northern Telecom, and DEC), ansi Annex D (ANSI standard T1.617), and q933a (ITU-T Q.933 Annex A).
# VC (virtual circuit)-A logical circuit between two network devices. A VC can be permanent (PVC) or switched (SVC). PVCs save bandwidth (there is no circuit establishment or teardown) but can be expensive. SVCs are established on-demand and are torn down when transmission is complete. VC status can be active, inactive, or deleted.
Dynamic Mapping with Inverse ARP
To correctly route packets, each DLCI must be mapped to a nexthop address. These addresses can be dynamically mapped using Inverse ARP or can be manually configured. After the address is mapped, it is stored in the router’s Frame Relay map table.

LMI Signaling Process
1 The router connects to a Frame Relay switch through a channel service unit/data service unit (CSU/DSU).
2 The router sends a VC status inquiry to the Frame Relay switch.
3 The switch responds with a status message that includes the DLCI’s information for the usable PVCs.
4 The router advertises itself by sending an Inverse ARP to each active DLCI.
5 The routers create map entries with the local DLCI and network-layer address of the remote routers. Static maps must be configured if Inverse ARP is not supported.
6 Inverse ARP messages are sent every 60 seconds.
7 LMI information is exchanged every 10 seconds.
Frame Relay Overview Summary
# Frame Relay is a connection-oriented Layer 2 protocol that allows several data connections (VCs) to be multiplexed onto a single physical link.
# Cisco routers support Frame Relay on the following types of serial connections: EIA/TIA-232, EIA/TIA-449, V.35, X.21, and EIA/TIA-530.
# Local DLCI addresses can be dynamically mapped using Inverse ARP or manually configured using static Frame Relay maps.
# Local Management Interface (LMI) signaling is used by Frame Relay switches to manage connections and maintain status between the devices. The supported LMI types are cisco, ansi, and q933a.
Continue on to the Frame Relay Configuration Article
Popularity: 1% [?]
Understanding Frame Relay Mappings to 0.0.0.0
Jun 29th
Hi Brian,
I ran into these nasty frame relay mappings during an initial lab set-up and was wondering why they are there, (even with inverse-arp disabled), and what they are actually doing. I was able to remove them only after writing my configuration to memory, and then performing a reload of the router.
Router(config-if)#do show frame map Serial0/0 (up): ip 0.0.0.0 dlci 113(0x71,0x1C10) broadcast, CISCO, status defined, inactive Serial0/0 (up): ip 0.0.0.0 dlci 105(0x69,0x1890) broadcast, CISCO, status defined, active Serial0/0 (up): ip 0.0.0.0 dlci 104(0x68,0x1880) broadcast, CISCO, status defined, active Serial0/0 (up): ip 0.0.0.0 dlci 103(0x67,0x1870) broadcast, CISCO, status defined, activeThanks,
Josh
Hi Josh,
This is actually an error relating to AutoInstall over Frame Relay. When the router boots up and does not have a configuration file saved in NVRAM, it attempts to run autoinstall to automatically find an IP address and download a config. The first thing the router does is to detect the encapsulation on its WAN interfaces, which in this case is Frame Relay. Once the router finds that it’s running Frame Relay, it attempts to send a config request via TFTP. In order to do this it needs an IP address, so it sends a BOOTP request out all DLCIs. Since the router doesn’t know what the unicast IP addresses are on the other ends of the circuits, it creates IPv4 mappings to 0.0.0.0 for all circuits and includes the “broadcast” keyword on them. This allows the router to encapsulate the BOOTP request out all DLCIs.
If you haven’t actually configured IP helper-address or a BOOTP server, the operation will fail. The result of this that we see is that when Frame Relay is re-enabled on the interfaces the mappings to 0.0.0.0 reappear. In some versions of IOS this can be fixed by removing Frame Relay and re-applying it, for example:
router#config t router(config)#interface s0/0 router(config-if)#encapsulation ppp router(config-if)#encapsulation frame-relay router(config-if)#end router#
In most versions however this does not work. Therefore the way to fix this is just to have the router not do autoinstall on bootup. Since the router does autoinstall because it doesn’t have a config saved in memory, the only way to 100% fix it is to save your config to NVRAM (wr m), and to reload.
Popularity: 1% [?]
Recent Comments