ARP

ARP stands for address resolution protocol and is defined by RFC 826. Address Resolution Protocol (ARP) is used to resolve the ethernet address of a NIC from an IP address in order to construct an ethernet packet around an IP data packet. This must happen in order to send any data across the network.

An IP packet (Layer 3) must be placed into an ethernet packet (layer 2) on an ethernet network to send data to a remote computer. The computer sending the data needs to have the Media Access Control (MAC) address of the ethernet network card of the remote computer in order to build the packet. Therefore the sending computer sends a broadcast asking what computer has the IP address that it wants to send the data to. The remote computer responds and the sending computer gets the MAC address and builds the packet.

The computer keeps a table of IP addresses and matching ethernet addresses in memory. This is called ARP cache. Before sending a broadcast, the sending computer will check to see if the information is in it's ARP cache. If the information is in the ARP cache it will complete the ethernet data packet without an ARP broadcast. Each entry normally lasts 20 minutes after it is created. RFC 1122 specifies that it should be possible to configure the ARP cache timeout value on the host. To examine the cache on a Windows, UNIX, or Linux computer type "arp -a".