Operation Manual – ARPH3C S3100 Series Ethernet Switches Chapter 1 ARP Configuration1-41.1.4 ARP ProcessFigure 1-2 ARP processSuppose that Host A and Host B are on the same subnet and that Host A sends amessage to Host B. The resolution process is as follows:1) Host A looks in its ARP mapping table to see whether there is an ARP entry forHost B. If Host A finds it, Host A uses the MAC address in the entry to encapsulatethe IP packet into a data link layer frame and sends the frame to Host B.2) If Host A finds no entry for Host B, Host A buffers the packet and broadcasts anARP request, in which the source IP address and source MAC address arerespectively the IP address and MAC address of Host A and the destination IPaddress and MAC address are respectively the IP address of Host B and anall-zero MAC address. Because the ARP request is sent in broadcast mode, allhosts on this subnet can receive the request, but only the requested host (namely,Host B) will process the request.3) Host B compares its own IP address with the destination IP address in the ARPrequest. If they are the same, Host B saves the source IP address and sourceMAC address into its ARP mapping table, encapsulates its MAC address into anARP reply, and unicasts the reply to Host A.4) After receiving the ARP reply, Host A adds the MAC address of Host B into its ARPmapping table for subsequent packet forwarding. Meanwhile, Host Aencapsulates the IP packet and sends it out.Usually ARP dynamically implements and automatically seeks mappings from IPaddresses to MAC addresses, without manual intervention.1.1.5 Introduction to ARP Source MAC Address Consistency CheckAn attacker may use the IP or MAC address of another host as the sender IP or MACaddress of ARP packets. These ARP packets can cause other network devices toupdate the corresponding ARP entries incorrectly, thus interrupting network traffic.
