4.3.12
Ek computer jaanta hai ki local network par woh IP address se kisse baat karna chahta hai, lekin network card (NIC) physically frames sirf MAC address use karke deliver kar sakta hai. ARP (Address Resolution Protocol) woh "phone book lookup" hai jo ek IP address ko MAC address mein convert karta hai taaki bits actually bheje ja sakein.
Intuition Do address worlds
Layer 3 (IP) logical aur routable hai — yeh packets ko networks ke across travel karne deta hai.Layer 2 (MAC/Ethernet) physical aur local hai — ek switch sirf MAC addresses samajhta hai, IPs nahi.
Jab host A, host B ko same LAN par kuch bhejna chahta hai, toh Ethernet frame ke destination field mein B ka MAC hona chahiye. Lekin application ne A ko sirf ek IP diya hai. Toh A ko IP → MAC resolve karna padta hai. Wahi gap ARP fill karta hai.
Agar ARP hota hi nahi toh KYA hota? Tumhe har machine ka MAC manually type karna padta jisse tum baat karte ho. ARP yeh kaam dynamically automate karta hai.
ARP ek Layer-2 protocol hai (directly Ethernet ke upar run karta hai, EtherType 0x0806) jo ek jaane-maane IPv4 address ko same broadcast domain (LAN) par uske MAC (hardware) address se map karta hai.
Mechanism ek broadcast request / unicast reply hai:
A apna ARP cache check karta hai. Agar B ka IP→MAC wahan hai, kaam khatam.
Agar nahi, toh A ek ARP Request broadcast karta hai: dest MAC = FF:FF:FF:FF:FF:FF (sabko), poochta hai "Who has 10.0.0.5? Tell 10.0.0.1."
LAN par har host ise dekhta hai; sirf B (10.0.0.5 ka owner) ek unicast ARP Reply se jawab deta hai: "10.0.0.5 is at AA:BB:CC:DD:EE:FF."
A mapping apne cache mein store karta hai aur real data frame bhejta hai.
Worked example Ek chote LAN par step-by-stepHost A (10.0.0.1, MAC 11:11:...) Host B (10.0.0.5) ko ping karta hai.
Step 1: A ka cache 10.0.0.5 ke liye empty hai. Kyun? Fresh boot — abhi kuch nahi seekha.Step 2: A ARP Request broadcast karta hai. Kyun broadcast? A ko B ka MAC nahi pata, toh ushe sabse ek saath poochhna padta hai.Step 3: Switch broadcast ko sabhi ports par flood karta hai. C, D ise ignore karte hain (unka IP nahi hai). Kyun ignore? "Target IP" field ≠ unka apna IP.Step 4: B seedha 11:11:... par unicast reply karta hai. Kyun unicast? B ne A ka MAC request ke source field se seekha — poore LAN ko pareshan karne ki zaroorat nahi.Step 5: A 10.0.0.5 → BB:BB:... cache karta hai aur finally ICMP echo bhejta hai.
Intuition Baar baar mat poochhoBroadcasting LAN par har machine ko pareshan karta hai. Har packet ke liye network flood karne se bachne ke liye, har host ek ARP cache rakhta hai — recently seekhe gaye IP→MAC pairs ki ek short-lived table.
IP ↔ MAC ↔ interface entries ki ek table (ip arp / arp -a), jisme har entry ka ek timeout hota hai (Linux/Windows par typically 1–20 min). Entries ho sakti hain:
dynamic — ARP se seekhi gayi, timeout ke baad expire hoti hain, aurstatic — manually pin ki gayi, kabhi expire nahi hoti.
HOW timeout help karta hai: agar B ka NIC swap ho ya B move kare, toh stale entry expire ho jaati hai aur A sahi MAC dobara seekh leta hai. Short timeout = fresh data lekin zyada broadcasts; long timeout = kam broadcasts lekin changes notice karne mein zyada time. Yahi engineering trade-off hai.
Definition Gratuitous ARPGratuitous ARP ek ARP message hai jo ek host apne khud ke IP ke baare mein, bina poochhe bhejta hai — kisi ne nahi poochha . Yeh ek ARP Request (ya Reply) hai jisme Sender IP == Target IP (host ka apna address) hota hai.
Intuition "Gratuitous" kyun?Normal ARP reactive hota hai — tum sirf tab reply karte ho jab poochha jaye. Gratuitous ARP proactive hota hai — tum sabki cache update karne ke liye apni mapping khud chilla ke batate ho.
YEH kis kaam aata hai (3 bade kaam):
Duplicate IP detection — boot par, ek host apna khud ka IP gratuitous-ARP karta hai. Agar koi aur reply kare , toh IP conflict hai.MAC change ke baad cache update — jaise failover : ek backup server 10.0.0.5 (Virtual IP) le leta hai lekin uska MAC alag hai. Woh gratuitous-ARP karta hai taaki har host turant 10.0.0.5 → new MAC update kare stale entries expire hone ka wait kiye bina.Switch MAC tables update karna taaki frames naye active machine tak pahunche.
Worked example Gratuitous ARP ke saath failoverEk web cluster VIP 10.0.0.100 share karta hai. Server1 (MAC S1) band ho jaata hai; Server2 (MAC S2) VIP le leta hai.
Gratuitous ARP ke bina: clients S1 ko bhejte rehte hain jab tak unka cache expire na ho → downtime .
Gratuitous ARP ke saath: Server2 broadcast karta hai "10.0.0.100 is at S2" . Yeh kyun kaam karta hai? Hosts announcement dekhne par existing cache entry overwrite kar dete hain → near-instant cutover.
Common mistake "ARP secure hai kyunki sirf sahi host reply karta hai."Kyun sahi lagta hai: honest case mein, sirf IP ka owner jawab deta hai. Flaw: ARP mein koi authentication nahi — koi bhi host ek forged reply bhej sakta hai claiming "gateway ka IP MY MAC par hai." Victims iss jhooth ko cache karte hain → traffic attacker ke paas jaata hai (man-in-the-middle ).
Fix: Dynamic ARP Inspection (DAI), critical hosts ke liye static ARP entries, port security.
Common mistake "ARP internet ke across / routers ke through kaam karta hai."Kyun sahi lagta hai: IP internet ke across kaam karta hai, aur ARP IPs resolve karta hai — toh surely yeh global hai? Nahi. ARP broadcast-based aur link-local hai; routers ARP broadcasts forward nahi karte. Remote host tak pahunchne ke liye, A remote host ke MAC ke liye nahi balki default gateway ke MAC ke liye ARP karta hai. Fix: ARP sirf same broadcast domain ke andar IPs resolve karta hai.
Common mistake "ARP request host B ke MAC par bheji jaati hai."Agar A ko B ka MAC pata hota toh use ARP ki zaroorat hi nahi hoti! Request ek broadcast hai (FF:FF:FF:FF:FF:FF); sirf reply unicast hoti hai.
Common mistake "ARP IPv6 mein bhi use hota hai."Kyun sahi lagta hai: IPv6 ko bhi IP→MAC mapping chahiye. Lekin IPv6 ARP ko NDP (Neighbor Discovery Protocol) se replace karta hai jo ICMPv6 multicast use karta hai (Neighbor Solicitation/Advertisement) — koi broadcasts nahi. Fix: ARP = sirf IPv4.
ARP kaunsi problem solve karta hai? Ek jaane-maane IPv4 (Layer-3) address ko MAC (Layer-2) address se map karna jo local LAN par Ethernet frame deliver karne ke liye chahiye.
ARP Request ka destination MAC kya hota hai? Broadcast address FF:FF:FF:FF:FF:FF.
ARP Reply broadcast hoti hai ya unicast, aur kyun? Unicast — reply karne wale ne requester ka MAC request ke source field se seekha, toh broadcast ki zaroorat nahi.
ARP ko identify karne wala EtherType kya hai? 0x0806.
ARP cache kya hai aur yeh kyun exist karta hai? IP↔MAC mappings ki ek timed table; yeh har single packet ke liye ARP request broadcast karne se bachata hai.
Dynamic aur static ARP entry mein kya fark hai? Dynamic entries seekhi jaati hain aur timeout par expire hoti hain; static entries manually configure ki jaati hain aur kabhi expire nahi hoti.
Gratuitous ARP packet ko kya define karta hai? Ek unsolicited ARP jisme Sender IP == Target IP hota hai (ek host apni khud ki mapping announce karta hai).
Gratuitous ARP ke do uses batao. Duplicate-IP detection aur MAC change (failover / VIP takeover) ke baad caches update karna.
ARP alag network par host tak kyun nahi pahunch sakta? ARP broadcast-based hai aur routers ARP broadcasts forward nahi karte; tum gateway ke liye ARP karte ho instead.
IPv6 mein ARP ki jagah kya aata hai? NDP (Neighbor Discovery Protocol) over ICMPv6.
ARP insecure kyun hai? Isme koi authentication nahi, toh forged replies ARP spoofing / man-in-the-middle enable karte hain.
Recall Feynman: ek 12-saal ke bacche ko explain karoSocho tum ek bade classroom mein "Sam" ko letter dena chahte ho, lekin tum sirf uska naam jaante ho, yeh nahi ki woh kahan baitha hai. Tum poore room mein chillate ho: "Sam kahan hai?" (yahi ARP request hai — sabko sunai deta hai). Sirf Sam haath uthata hai aur kehta hai "Main yahan hun, seat 5 mein!" (woh reply hai). Ab tum seedha seat 5 par jaate ho — aur tum ek sticky note par likh lete ho taaki agli baar chillana na pade (yahi cache hai). Gratuitous ARP tab hota hai jab Sam khud uth ke announce karta hai "Hey sablog, main ab seat 5 mein hun!" — useful hota hai agar usne abhi seat change ki ho aur chahta ho ki sabke sticky notes turant update ho jaayein.
"Broadcast the question, Unicast the answer, Cache the result, Gratuitously announce a change."
B-U-C-G → "Big Ugly Cats Gratuitous."
Answers cover karo: (1) Request MAC? (2) Reply type? (3) Sender==Target IP ka matlab? (4) Kya ARP routers cross karta hai?
Ethernet & MAC addressing — ARP Layer-2 delivery ke liye IP→MAC gap fill karta hai.IP addressing & subnetting — host subnet mask use karke decide karta hai local vs remote (ARP target vs gateway).Default gateway & routing — remote traffic gateway ke MAC ke liye ARP karta hai.Switching & MAC learning tables — switches frame sources se ports seekhte hain; gratuitous ARP unhe refresh karta hai.NDP — IPv6 Neighbor Discovery — ARP ka IPv6 successor.Network security — MITM & ARP spoofing — ARP ki authentication ki kami exploit karta hai.DHCP — newly assigned hosts aksar IP conflicts detect karne ke liye gratuitous-ARP karte hain.
