Key TakeAway

<aside> 💡

On a Linux host, use the Ping command within different Network Namespaces to observe the complete transmission and reception process of ICMP packets, and gain a deeper understanding of how the Linux Kernel resolves the target MAC address through ARP packets.

By utilizing Namespace, VETH, and IP commands, implement and explore the operational mechanism of ARP in the Linux Kernel, mastering the core principles of Linux networking.

</aside>

P.S. Before staring this journey, I recommend you to know the Network Namespace and VETH concepts, feel free to check out my earlier article: 1. Network Namespace and Virtual Ethernet (VETH)

Address Resolution Protocol (ARP)

The Concept of ARP

<aside> 💡

ARP (Address Resolution Protocol) is a protocol used in IPv4 networks to map IP addresses to MAC addresses. It serves as an essential component in the interaction between the Network Layer (Layer 3) and the Data Link Layer (Layer 2) within the TCP/IP protocol stack. ARP is primarily used for communication between devices within a local area network (LAN).

</aside>

Core Function

The main function of ARP is to solve the following problem:

Within the same local area network (LAN), when a device knows the destination's IP address, how can it obtain the corresponding MAC address in order to transmit packets at the Data Link Layer (Layer 2).

Key Characteristics

• Broadcast and Unicast: ARP requests are broadcast (sent to all devices on the network), while ARP replies are unicast (sent only to the requester).
• Scope of Application: ARP only works within the same subnet (Layer 2 network). Communication across different subnets relies on routers and Proxy ARP.
• Protocol Layering: ARP operates at the Data Link Layer (Layer 2) but serves the IP protocol at the Network Layer (Layer 3).
• Security Issues: ARP lacks authentication mechanisms, making it vulnerable to ARP spoofing attacks, where an attacker can forge MAC addresses to intercept or redirect network traffic.

How It Works

1. ARP Request
   • When Device A wants to communicate with Device B but only knows B’s IP address (e.g., 192.168.1.2), it broadcasts an ARP request packet to the local network.
   • The request packet includes:
     • The sender’s IP and MAC addresses.
     • The target IP address (e.g., 192.168.1.2).
     • The target MAC address field is left blank (usually filled with all zeros).
   • This broadcast packet is received by all devices on the same subnet.
2. ARP Reply
   • When Device B receives the ARP request and sees that the target IP matches its own, it sends back an ARP reply packet.
   • The reply contains B’s MAC address and is sent directly to Device A (unicast).
   • Upon receiving the reply, Device A stores the IP-MAC mapping in its ARP table (ARP cache) for future use.

ARP Table