Table of Contents
ARP Format
ARP message is encapsulated and forwarded directly with Ethernet header. The type code 0x0806 in the Ethernet header indicates that the data portion is an ARP message.
| Field | Size(bit) | Content |
|---|---|---|
| Hardware Type | 16 | For Ethernet, fixed at 0x0001 |
| Protocol Type | 16 | For IPv4, fixed at 0x0800 |
Hardware Size | 8 | Size of MAC address (bytes). 0x06 |
Protocol Size | 8 | Size of IP address (in bytes). 0x04 |
| Opcode | 16 | ARP Request:0x0001 ARP Reply:0x0002 |
| Sender MAC address | 48 | Source MAC address |
| Sender IP address | 32 | Source IP address |
Target MAC address | 48 | Target MAC address |
Target IP address | 32 | Target IP address |
This format is for TCP/IP communication over Ethernet.
Related article
The following page explains how the ARP works.
Example of ARP message
Let’s take a closer look at the actual message content of ARP request and ARP reply with the following simple network diagram.
The MAC addresses of R1 and R2 are configured to easy-to-understand values.
The ARP request/reply capture file shown here can be downloaded from “arp_capture.pcapng”
ARP Request
When R1 pings R2 (192.168.12.2), an ARP is automatically processed. R1 broadcasts an ARP request to find the MAC address of 192.168.12.2. Capturing that ARP request looks like this.
| Field | Size(bit) | Content |
| Hardware Type | 16 | 0x0001 |
| Protocol Type | 16 | 0x0800 |
Hardware Size | 8 | 0x06 |
Protocol Size | 8 | 0x04 |
Opcode | 16 | 0x0001(ARP Request) |
Sender MAC address | 48 | 0x0000.0000.1111(R1 MAC address) |
Sender IP address | 32 | 192.168.12.1(R1 IP address) |
Target MAC address | 48 | 0x0000.0000.0000 |
Target IP address | 32 | 192.168.12.2(R2 IP address) |
MAC addresses are written in 2-byte delimited notation.
ARP Reply
In response to an ARP request from R1, R2 with the Target IP address returns an ARP reply to inform the MAC address. The ARP reply is captured as follows.
| Field | Size(bit) | Content |
Hardware Type | 16 | 0x0001 |
Protocol Type | 16 | 0x0800 |
Hardware Size | 8 | 0x06 |
Protocol Size | 8 | 0x04 |
Opcode | 16 | 0x0002(ARP Reply) |
Sender MAC address | 48 | 0x0000.0000.2222(R2 MAC address) |
Sender IP address | 32 | 192.168.12.2(R2 IP address) |
Target MAC address | 48 | 0x0000.0000.1111(R1 MAC address) |
Target IP address | 32 | 192.168.12.1(R1 IP address) |
TCP/IP
- IP(Internet Protocol) : The Most Important Data Transfer Protocol
- Ping “Will the data be transfered properly?”
- Ping command on Windows OS
- Traceroute : Which router does the data go through?
- ICMP Redirect
- Where’s the Trouble? Ping and Traceroute
- ARP(Address Resolution Protocol)
- ARP Format
- Gratuitous ARP(GARP)
- nslookup command : Verifying DNS name resolution
- DHCP : Automatically Assign IP Address
- Cisco IOS DHCP Server Configuration and Verification Commands
- Cisco Router DHCP Server Configuration Example
- DHCP Relay Agent
- DHCP Relay Agent Configuration Example [Cisco]
- Summary of DHCP Server Placement
- TCP/IP Configuration Summary
- ipconfig command : To verify TCP/IP configurations on Windows OS
- Commands to Verify TCP/IP Configuration On Linux (Ubuntu)
- Web Proxy Server
- FTP : Representative File Transfer Protocol
- TFTP(Trivial File Transfer Protocol)
- TFTP Client on Windows10/11