Hey what's up guys welcome to CertBros. In this video we're going to be talking
about ARP. So what is ARP? ARP stands for address resolution protocol and is
designed to discover MAC addresses and then map them to an IP address. So let's
see how this works. In our example we have four computers
and a switch. Our computers have been assigned IP addresses 192.168.0.1 .2
.3 and .4. Let's say host A wants to communicate with host D
We already know the IP address maybe we typed it in manually. But remember
switches are layer 2 devices which use MAC addresses not IP addresses. So for
host A to communicate with host D it somehow needs to find out its MAC
address. The way it does this is simple, host A will shout out to the entire
network saying who is 192.168.0.4
Tell me your MAC address. And that message is sent as a broadcast. We've already looked
at broadcast messages and remember they will be sent with a destination address
of all F's and the switch will send this out of every interface except the one
that received it. host B and host C we'll look at this
message and think 192.168.0.4? that's not me
and they discard the frame. But when host D sees the message he says
oh 192.168.0.4? That's me! Here is my MAC
address. And then host D replies with his MAC
address directly to host A. When our computers learn MAC addresses they are
stored in a table for future use. It lists the known IP addresses and their
associated MAC addresses. This table is called the ARP cache
From this point forward if host A needs to talk to host D it just needs to lookup
the IP address in the ARP cache to find the correct MAC address
And now they can both send frames happily
So that was pretty simple. Let's see this live and in action. I'm going to click
the start button and type PowerShell. Now we're going to need to run this as admin
so right click run as administrator. Accept the UAC
and when that loads I'm going to start by typing ARP - a
this is going to show us the computers app cache. We have the Internet address
which is the IP address. The physical address which is the linked MAC address
and we have the type, this shows us if the MAC address was learned by ARP or if
it's a static entry. You can see we have three static entries and this is by
default. The top one is something called a direct broadcast address. You should be
able to recognize this by the IP address. It's the last IP in the network. you
should also be able to recognize it by the associated MAC address which is all
F's. This tells us this is a broadcast address. The bottom two are multicast
addresses. You can see that from the first six characters of the MAC address
So because my computer already knows the MAC address of 192.168.0.4. I'm going to run ARP - D
192.168.0.4 and this is going to delete that entry. If I then type ARP - a again we see that
entry has been removed. Now I'm going to open up a program
called a Wireshark which will capture all of the traffic on this computer
We just need to select the interface and hit the start capture button
While that's running I'm going to open PowerShell again and type ping
192.168.0.4 this will trigger an ARP request
Once the ping is finished we'll head back over to Wireshark and hit the stop
button
There's not a huge amount to go through here but if you're trying this at home
you will likely see a lot more information
This is a fresh PC so not many applications are running. We can filter
the capture by clicking at the top and typing ARP. Now we can see our ARP
conversation happening. We can see the source and destination. Keep in mind
though Wireshark will try to resolve these MAC addresses to something a bit
more readable. If we look at the info column here we can see up requesting the
MAC address of 192.168.0.4
With the first the request selected, we can look at the bottom of the screen and see our source and
destination MAC address. So host A is the source and the destination is a
broadcast MAC address. If we select the second one down which is the reply you
can see in the info column host D is replying with its MAC address. This reply
is saying hey that's me this is my MAC address
If we look at the bottom we can see host D's MAC address is now the source and
host A's MAC address is now the destination. And now if we go back to our
PowerShell window run ARP - a again we can see that the
entry is now back in the table. Let's look at one more scenario. Here we have
two hosts, a router and a web server. If host A wants to communicate with the web
server, what will it do first? Well if we type in the IP address of the webserver
host A will compare that IP address with its own. It will look at 192.168.0.1 and
10.10.10.10 and it will realize the webserver is not in the
same network. ARP requests only happen in layer 2
networks, so we can't send an ARP request to the webserver. So what do we do?
Knowing it needs to get off the network host A will do the same ARP request, but
not to the webserver, for its default gateway, which in this example is the
router. The default gateways is like the door out of the network and is
configured alongside the IP address. If a device needs to communicate out of the
network it's sent to the default gateway. So we send an ARP request to 192.168.0.254
and request the MAC address. Host B will drop this request
the router will respond with its MAC address just like we've seen already
and now we have the MAC address for the default gateway host A can start to send
data. The data will contain the MAC address of
the router but it will have the IP address of the webserver. The router
will handle things from there. We will go over this in more detail as we move on
to routing. This video is part of our full CCNA course which can be found in
the description, so please feel free to go and check that out. That's it for ARP
If you like this video please give it a like, comment and don't forget to
subscribe. The support from you guys really does help this channel grow. Other
than that, thank you for watching.