IPv6 Network Administration

MAC Layer Address Resolution

IPv4 Ethernet networks require a mechanism for nodes to find out which link-layer addresses correspond to which layer three addresses. In other words, how does a machine locate the link-layer address for a given IP address that is on your network? In the vast majority of conventional networks today, this is done using a protocol called ARP, defined in RFC 826.

The protocol works as follows: hosts maintain a table of the link-layer addresses corresponding to IPv4 addresses. When a packet needs to be transmitted, the host checks this table and uses the link-layer address, if it is present. If not, the host broadcasts an ARP request message saying, "Here are my IP and link-layer addresses, who knows the link-layer address for X?" The target host is expected to construct a reply and send it to the requester. Note that the ARP request is a broadcast and contains the information needed to form a table entry for the requesting host. Crucially, this allows the reply to be sent without issuing any further ARP requests.

Although ARP works very well when no-one is fiddling with it, it has a number of key deficiencies when it comes to security. First, when you receive an ARP reply, there is no guarantee that it has actually come from the correct system. Anyone who is on the same medium can fake this reply if desired, and there is nothing that can easily prevent this. Sophisticated attackers, having targeted a key machine, can perform a DoS attack or otherwise disrupt ...