The ARP Packet

An ARP packet works at approximately the same layer as IP. It communicates with the data-link services provided by the physical medium, and as such, ARP is a separate protocol than IP (and is identified separately by any network that both categorizes the protocols being carried in the low-level frames and supports ARP directly). The ethertype for ARP is 0806 as opposed to the ethertype for IP, which is 0800.

According to RFC 826, an ARP packet is made up of nine fields. The total size of the packet will vary according to the size of the physical addresses in use on the local network medium.

The fields in an ARP packet are listed in Table 3.1.

Table 3.1. The Fields in an ARP Packet

Header Field

Bytes

Usage Notes

Hardware Type

2

Identifies the medium-specific address type being requested.

Protocol Type

2

Identifies the higher-layer protocol information being discussed (which is always IP as far as we’re concerned).

Hardware Address Length

1

Specifies the size of the physical medium’s hardware address, in bytes. Since each network uses different physical addressing mechanisms, this field is required for other fields further in the ARP packet.

Protocol Address Length

1

Specifies the size of the higher-layer protocol’s address, in bytes. This is always 4 (32 bits) for IP.

Message Type

2

Identifies the purpose for this ARP packet (“request” or “response”).

Source Hardware Address

varies

Identifies the hardware address of the system issuing the ARP broadcast.

Source IP Address

varies

Identifies ...

Get Internet Core Protocols: The Definitive Guide now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.