Operation Manual – ARPH3C S3100-52P Ethernet Switch Chapter 1 ARP Configuration1-41.1.4 ARP ProcessFigure 1-2 ARP processSuppose that Host A and Host B are on the same subnet and that Host A sends amessage to Host B. The resolution process is as follows:1) Host A looks in its ARP mapping table to see whether there is an ARP entry forHost B. If Host A finds it, Host A uses the MAC address in the entry to encapsulatethe IP packet into a data link layer frame and sends the frame to Host B.2) If Host A finds no entry for Host B, Host A buffers the packet and broadcasts anARP request, in which the source IP address and source MAC address arerespectively the IP address and MAC address of Host A and the destination IPaddress and MAC address are respectively the IP address of Host B and anall-zero MAC address. Because the ARP request is sent in broadcast mode, allhosts on this subnet can receive the request, but only the requested host (namely,Host B) will process the request.3) Host B compares its own IP address with the destination IP address in the ARPrequest. If they are the same, Host B saves the source IP address and sourceMAC address into its ARP mapping table, encapsulates its MAC address into anARP reply, and unicasts the reply to Host A.4) After receiving the ARP reply, Host A adds the MAC address of Host B into its ARPmapping table for subsequent packet forwarding. Meanwhile, Host Aencapsulates the IP packet and sends it out.Usually ARP dynamically implements and automatically seeks mappings from IPaddresses to MAC addresses, without manual intervention.1.1.5 Introduction to ARP Attack DetectionI. Man-in-the-middle attackAccording to the ARP design, after receiving an ARP response, a host adds theIP-to-MAC mapping of the sender into its ARP mapping table even if the MAC addressis not the real one. This can reduce the ARP traffic in the network, but it also makes
