4.2 Address Resolution Protocol (ARP) and IPv6 Neighbor Discovery

4.2 Address Resolution Protocol (ARP) and IPv6 Neighbor Discovery

Quick Answer: The Address Resolution Protocol (ARP, RFC 826) maps 32-bit IPv4 addresses to 48-bit MAC addresses. An ARP Request is broadcast to FF:FF:FF:FF:FF:FF, and the target device responds with a unicast ARP Reply. Resolved mappings are stored in the router's ARP cache (with a 4-hour default aging timer in Nokia SR OS). ARP Announcements refresh bindings and source-MAC learning; RFC 5227 conflict-detection Probes use sender IP 0.0.0.0. IPv6 replaces broadcast-based ARP with the Neighbor Discovery Protocol (NDP) running over ICMPv6, using Neighbor Solicitation (NS, Type 135) sent to targeted Solicited-Node Multicast addresses (ff02::1:ffxx:xxxx) and unicast Neighbor Advertisement (NA, Type 136).

TCP/IP applications communicate using logical Layer 3 IP addresses. However, physical local area networks (such as Ethernet IEEE 802.3) cannot deliver frames using IP addresses; network interface cards (NICs) transmit and receive data based on physical Layer 2 MAC addresses. Therefore, a translation mechanism is required to bridge the logical network layer with the physical link layer. In IPv4, this bridge is provided by the Address Resolution Protocol (ARP). In IPv6, ARP is replaced by the more efficient Neighbor Discovery Protocol (NDP).

---

Address Resolution Protocol (ARP) Mechanics in IPv4

Standardized in RFC 826, ARP operates directly above the data link layer. ARP packets are encapsulated directly inside Ethernet frames using EtherType 0x0806. Because ARP operates below the network layer, ARP packets do not contain an IPv4 header.

The ARP Packet Format

An ARP message contains nine distinct fields totaling 28 bytes for an Ethernet/IPv4 implementation:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Hardware Type         |         Protocol Type         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Hw Addr Len  | Proto Addr Len|            Opcode             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     Sender Hardware Address                   |
|                            (Bytes 0-3)                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Sender Hw Addr (Bytes 4-5)   |     Sender Protocol Address   |
|                               |            (Bytes 0-1)        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Sender Proto Addr (Bytes 2-3)|    Target Hardware Address    |
|                               |            (Bytes 0-1)        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     Target Hardware Address                   |
|                            (Bytes 2-5)                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     Target Protocol Address                   |
|                            (Bytes 0-3)                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Detailed Field Breakdown:

1. Hardware Type — HTYPE (16 bits): Defines the network link-layer type. For Ethernet, this value is 0x0001 (decimal 1).
2. Protocol Type — PTYPE (16 bits): Specifies the network-layer protocol being resolved. For IPv4, this value is 0x0800 (decimal 2048, matching the IPv4 EtherType).
3. Hardware Address Length — HLEN (8 bits): Indicates the length of the physical hardware address in bytes. For 48-bit Ethernet MAC addresses, the value is 6.
4. Protocol Address Length — PLEN (8 bits): Indicates the length of the logical network address in bytes. For 32-bit IPv4 addresses, the value is 4.
5. Opcode (16 bits): Specifies the specific operational function of the ARP message:
   • 1 = ARP Request (soliciting a MAC address)
   • 2 = ARP Reply (responding with the resolved MAC address)
6. Sender Hardware Address — SHA (48 bits / 6 bytes): The Layer 2 MAC address of the device transmitting the ARP message.
7. Sender Protocol Address — SPA (32 bits / 4 bytes): The Layer 3 IPv4 address of the device transmitting the ARP message.
8. Target Hardware Address — THA (48 bits / 6 bytes): The Layer 2 MAC address of the device being queried. In an ARP Request, this field is set to all zeros (00:00:00:00:00:00) because the sender does not yet know it. In an ARP Reply, it contains the requester's MAC address.
9. Target Protocol Address — TPA (32 bits / 4 bytes): The Layer 3 IPv4 address of the target device whose MAC address is being requested.

---

Step-by-Step ARP Resolution Workflow

Suppose Host A (192.168.1.10, MAC 00:11:22:33:44:AA) needs to transmit an IP packet to Host B (192.168.1.20, MAC 00:11:22:33:44:BB) residing on the same local Ethernet segment:

Step 1: Cache Inspection

Host A checks its local ARP cache table. If an entry exists for 192.168.1.20, Host A immediately retrieves the MAC address and encapsulates the packet into an Ethernet frame. If no entry exists, Host A initiates address resolution.

Step 2: Encapsulation and Broadcast of the ARP Request

Host A builds an ARP Request packet with Opcode 1:

• Sender MAC: 00:11:22:33:44:AA | Sender IP: 192.168.1.10
• Target MAC: 00:00:00:00:00:00 | Target IP: 192.168.1.20

Host A encapsulates this ARP payload into an Ethernet frame:

• Source MAC: 00:11:22:33:44:AA (Host A's MAC)
• Destination MAC: FF:FF:FF:FF:FF:FF (Layer 2 Broadcast)
• EtherType: 0x0806 (ARP)

Host A transmits the frame onto the network. Ethernet switches flood this broadcast frame out all ports belonging to the same VLAN.

Step 3: Segment Processing and Target Inspection

Every device connected to the local VLAN receives and processes the broadcast frame:

• The receiving nodes inspect the Target Protocol Address (TPA = 192.168.1.20).
• Nodes that are not the target normally do not answer; receiving and inspecting the broadcast can still consume resources.
• Host B identifies its own IP address as the target. Prior to replying, Host B inspects the Sender MAC and Sender IP fields and updates its own ARP cache with Host A's mapping (192.168.1.10 $\rightarrow$ 00:11:22:33:44:AA), knowing that return communication will follow.

Step 4: Transmission of the Unicast ARP Reply

Host B crafts an ARP Reply packet with Opcode 2:

• Sender MAC: 00:11:22:33:44:BB | Sender IP: 192.168.1.20
• Target MAC: 00:11:22:33:44:AA | Target IP: 192.168.1.10

Host B encapsulates this packet into an Ethernet frame:

• Source MAC: 00:11:22:33:44:BB (Host B's MAC)
• Destination MAC: 00:11:22:33:44:AA (Unicast directly to Host A)
• EtherType: 0x0806 (ARP)

Host B transmits the frame. The Ethernet switches look up Host A's MAC in their MAC address forwarding tables (FDB) and forward the frame only to the port connected to Host A.

Step 5: Cache Population and Data Transmission

Host A receives the unicast ARP reply, extracts Host B's MAC address from the Sender Hardware Address field, and inserts an entry into its ARP cache (192.168.1.20 $\rightarrow$ 00:11:22:33:44:BB). Host A now encapsulates and transmits the queued IP data packet directly to Host B.

---

The ARP Cache Table and Entry Lifecycle

To prevent the network from being flooded by ARP broadcast requests for every individual IP packet, hosts and routers store resolved bindings in a local memory table termed the ARP Cache (or ARP Table).

ARP Entry Attributes in Nokia SR OS

On a Nokia Service Router (7750 SR / 7450 ESS), you inspect the ARP table using the command:

*A:Router# show router arp

===============================================================================
ARP Table (Router: Base)
===============================================================================
IP Address      MAC Address       Expiry     Type     Interface
-------------------------------------------------------------------------------
192.168.1.1     00:16:4d:55:01:00 00h00m00s  Other    system
192.168.1.10    00:11:22:33:44:aa 03h52m14s  Dynamic  to-LAN-1
192.168.1.20    00:11:22:33:44:bb 03h48m02s  Dynamic  to-LAN-1
192.168.1.254   00:00:5e:00:01:01 00h00m00s  Static   to-LAN-1
===============================================================================
No. of ARP Entries: 4

• Dynamic Entries: Learned automatically through the exchange of ARP requests and replies. Dynamic entries have an aging timeout (expiry timer).
• Default Aging Timer: In Nokia SR OS, the default dynamic ARP aging timeout is 14,400 seconds (4 hours). ARP requests or gratuitous ARP from the host can refresh a binding. Otherwise it ages under the configured timer; ordinary IP traffic alone must not be assumed to reset every ARP aging rule.
• Static Entries: Manually entered by a network administrator. Static entries do not use dynamic aging; saved configuration can recreate them after reboot.

---

Specialized ARP Operations: Gratuitous ARP and Proxy ARP

Beyond standard point-to-point host resolution, network protocols utilize specialized ARP behaviors:

1. Gratuitous ARP (GARP)

A Gratuitous ARP (GARP) is an ARP message where the Sender Protocol Address (SPA) and the Target Protocol Address (TPA) are identical (the host queries its own IP address). It is transmitted as a broadcast frame (FF:FF:FF:FF:FF:FF).

GARP serves two essential network functions:

1. Conflict detection: An RFC 5227 ARP Probe uses sender IP 0.0.0.0 and the proposed address as target IP. An Announcement instead uses the claimed address in both fields. The host observes conflicting traffic before using the address; conflict handling depends on the implementation and situation.
2. Updating Switch MAC Tables during Redundancy Failover: In High Availability (HA) configurations such as Virtual Router Redundancy Protocol (VRRP) or dual-homed server clusters, an active router shares a Virtual IP (VIP) and Virtual MAC (VMAC) with a backup router. When the active router fails and the backup takes over mastership, the new master immediately emits a Gratuitous ARP. All LAN switches receiving this GARP immediately update their MAC forwarding tables (FDB / CAM tables), redirecting frame forwarding out the new master's switch port which helps relearn the new location; packets can still be lost during failover.

2. Proxy ARP (RFC 1027)

Proxy ARP is a technique where a Layer 3 router answers ARP requests on behalf of a target host located on a different network or subnet:

• If Host A on Subnet 1 has a misconfigured subnet mask or no default gateway, and attempts to ARP for Host C on Subnet 2, Host A's broadcast will not reach Subnet 2 (routers do not forward broadcasts).
• If Proxy ARP is enabled on the intervening router, the router recognizes that it has a valid route to Subnet 2. The router responds to Host A's ARP request with the router's own interface MAC address.
• Host A forwards all frames destined for Host C to the router, which then routes them normally.

Exam Tip: While Proxy ARP helps legacy or misconfigured devices communicate without default gateways, it introduces substantial drawbacks: it increases ARP table sizes, conceals configuration errors, and introduces security vulnerabilities by making the router a target for man-in-the-middle attacks. In modern enterprise and service-provider networks, Proxy ARP is disabled by default.

---

IPv6 Neighbor Discovery Protocol (NDP)

In IPv6, the IETF completely removed the concept of network-wide broadcasts. Broadcast storms degrade switch bandwidth and force every host on a segment to interrupt its CPU to parse irrelevant frames. Consequently, IPv6 completely eliminates ARP.

Address resolution in IPv6 is handled by the Neighbor Discovery Protocol (NDP), standardized in RFC 4861. NDP operates at Layer 3, encapsulated inside ICMPv6 packets (IPv6 Next Header value 58).

The Five Core NDP Messages

Solicited-Node Multicast Address Resolution

Instead of broadcasting to all devices, an IPv6 host resolving a neighbor's MAC transmits a Neighbor Solicitation (NS) to a targeted Solicited-Node Multicast Address:

• Solicited-Node Prefix: ff02::1:ff00:0/104
• Generation Rule: Take the lower 24 bits (last 6 hexadecimal characters) of the target node's unicast IPv6 address and append them to ff02::1:ff.

Worked Example:

Target IPv6 Address: 2001:db8:acad:1::4a:25bc

• Lower 24 bits: 4a:25bc
• Resulting Solicited-Node Multicast: ff02::1:ff4a:25bc

Hardware-Level Efficiency (Ethernet Multicast Mapping)

When the sending node encapsulates the Neighbor Solicitation into an Ethernet frame, the destination MAC is derived directly from the IPv6 multicast address using the IEEE prefix 33-33:

$$\text{Multicast MAC: } \mathbf{33:33:FF:4A:25:BC}$$

Because network interface cards (NICs) filter multicast MAC addresses in hardware:

1. Group membership and hardware filters can reduce host processing.
2. Switch flooding, NIC behavior, and shared multicast mappings can still deliver frames to other hosts; the IPv6 stack checks the destination and target.
3. The target node receives the NS and returns a unicast Neighbor Advertisement (NA, Type 136) containing its 48-bit MAC address.

IPv4 ARP vs. IPv6 NDP Comparison

Primary technical reference

Specification or Nokia manual, checked October 20, 2026. Examples are teaching scenarios, not captured router execution.