ARP is another protocol found at the Internet layer of the TCP/IP model. As the name suggests, ARP is a protocol used to resolve addresses – in this case, finding the MAC address that corresponds to an IP address. Remember that data is encapsulated before being sent over the network. Even though a system may know the IP address it wants to ultimately send data to, it may not know the MAC address. On an Ethernet LAN, systems communicate directly using CSMA/CD, and as such must know the MAC address of the system that data must be sent to next.
Recall that MAC addresses are fixed. IP addresses, on the other hand, are not. Systems can be manually configured with an IP address, or they can obtain one using the Dynamic Host Configuration Protocol (DHCP). As such, it doesn’t make much sense to have a static mapping between the two, since IP addresses may change. Instead, when a system needs to obtain the MAC address associated with an IP address, it sends out a broadcast message asking that the system with the specified IP address reply with its MAC address. Once it receives a reply, the answer is cached for a limited period of time (typically between 2 and 20 minutes) in the system’s ARP table. Caching helps to ensure that ARP broadcasts don’t get out of hand and overwhelm the network.
Since an ARP request is a broadcast, it will be seen by every system in the same broadcast domain. When a system comes across an ARP request, it will check to see if it is the intended recipient. If it is, the system will process the frame. If not, the frame is ignored.
When a system wishes to communicate with another system in a different broadcast domain, recall that the packets must be sent to a router. In this case, the ARP request isn’t looking for the MAC address of the destination host (since the broadcast would never reach it), but instead the MAC address of the router interface to which the frame must first be forwarded.
