Internet Core Protocols: The Definitive Guide

The ARP Packet

An ARP packet works at approximately the same layer as IP. It communicates with the data-link services provided by the physical medium, and as such, ARP is a separate protocol than IP (and is identified separately by any network that both categorizes the protocols being carried in the low-level frames and supports ARP directly). The ethertype for ARP is 0806 as opposed to the ethertype for IP, which is 0800.

According to RFC 826, an ARP packet is made up of nine fields. The total size of the packet will vary according to the size of the physical addresses in use on the local network medium.

The fields in an ARP packet are listed in Table 3.1.

Table 3.1. The Fields in an ARP Packet

Header Field	Bytes	Usage Notes
Hardware Type	2	Identifies the medium-specific address type being requested.
Protocol Type	2	Identifies the higher-layer protocol information being discussed (which is always IP as far as we’re concerned).
Hardware Address Length	1	Specifies the size of the physical medium’s hardware address, in bytes. Since each network uses different physical addressing mechanisms, this field is required for other fields further in the ARP packet.
Protocol Address Length	1	Specifies the size of the higher-layer protocol’s address, in bytes. This is always 4 (32 bits) for IP.
Message Type	2	Identifies the purpose for this ARP packet (“request” or “response”).
Source Hardware Address	varies	Identifies the hardware address of the system issuing the ARP broadcast.
Source IP Address	varies	Identifies ...