Hey guys and welcome back. So now what I want to talk to you about is something called address
resolution protocol because this is something that we have to understand for our basic network
communication. So the address resolution protocol is more commonly known and referred to simply as
ARPARP. So let's actually talk about what this protocol is doing and then we'll look at the
command that we can do to inspect our ARP information honor system. So think about this,
okay. Let's imagine we have a whole bunch of devices. Let's say device one is here,
device two is here, device three is here and device four. Now all four of these devices,
let's say they're connected with a network switch. So this can be a switch right here.
Let's pretend and connect in to you, connect in, connect in and connect in. So let's imagine
that this device here has the IP address of 192.168.1.1 and this one is 192.168.1.2. Over here we
have 192.168.1.3 and device number four is 192.168.1.4. Perfect. So let's imagine that this device
over here, device number one, wanted to communicate with device number three. Now I'm going to assume
that all of these devices have a network mask of a slash 24. If you can remember your subnetting
basics from LPIC one, that would mean that all of these devices are on the same network. So
when devices are on the same local network, can you remember how they actually communicate?
They actually don't communicate via IP addresses directly. Instead, the way they speak to one
another is via their MAC addresses, i.e. their layer two address. So if this device 192.168.1.1
wants to talk to this device 192.168.1.3 and they have to communicate via MAC addresses,
how is this communication going to be facilitated? i.e. how does this device
learn what this device's MAC addresses? Well, the answer lies in what we're talking about right
now. The answer lies within the address resolution protocol. So the way this is going to happen is
that the sender, i.e. this device here, is going to send out a broadcast message. That means that
it's going to communicate this message to all devices on the local network. And really what
it's going to ask in this message is who has the IP address of 192.168.1.3 because that is who I want
to talk to. So the message goes into the switch and the switch is going to broadcast it out to all
of these ports here. So to this device here and to this device here and this device right here.
Now device number two gets this message saying who is 192.168.1.3 and device two knows hey,
that is not me so I'm just going to discard this message and not pay attention to it. Similarly
device number four gets the same message who is 192.168.1.3. This device also says well that's
not me I'm going to discard this message and just ignore it but when it comes to device number three,
device number three is going to recognize hey, this is my IP address. Now this wasn't the only
instruction within the original message up here. We didn't just ask who is 192.168.1.3. We actually
asked who is 192.168.1.3. Identify yourself and then tell me your MAC address. So this device says
hey the message is going to me who is a sender 192.168.1.1. I'm going to send a message back
saying my MAC address is and then whatever the MAC address happens to be that hexadecimal value.
So now this device here can associate a particular MAC address. Let's just say the MAC address was
0001 0001 0003 whatever and now this device up here can keep a local copy of this information
binding this IP address to this MAC address. So whenever we happen to have a communication
destined for this address, we know we can communicate to that device via this MAC address.
Now like I say this storage of information whereby we keep a copy of the IP address and bind it to
the MAC address otherwise known as the hardware address. We can have multiple entries here so
lots of different IP addresses maybe the MAC address and IP address binding for 192.168.1.2
as well as 1.3 as well as 1.4 if we so need and all of this information is cached and held in
what is called the ARP table. So this is exactly what we're going to be looking at right now. So
really easy command to be able to use we simply type the command ARP. So check this out here we
have some information here we have 192.168.0.39 this device is on the same network as us we are 0.68
and if we want to communicate with this device on our local network we would have to be able to
communicate with that device via its layer to address i.e its MAC address and luckily for us
we have learned and stored that MAC address there it is right there. So now the advantage is once we
have learned this information and we have stored it in our ARP cache every time we want to send a
message to this device we don't have to send it a broadcast every single time and disrupt the entire
network we can just ask the question once once that device responds with its MAC address we
simply just store that information in our ARP cache within the table. Now like I say this is
caching information after a while this information will be eventually flushed so that if we happen to
need to communicate with that device much later on we will indeed have to reissue that broadcast
communication and relearn the MAC address and the event that potentially has changed and then
once again we will store that information for a predetermined period of time. Now if you happen
to go into the man page for the ARP command and we scroll on down we can see different options
available to us via this command so say for example we want to manually delete an entry within the
ARP table we could do so using this particular command using the ARP command specify the interface
you want to target then using the dash D flag and then the IP address that we would want to
delete from the ARP table. Similarly if you want to add a new entry you can use the dash S flag
specify that IP address and then bind it manually to a hardware address this is going to allow you
to manually set up a new entry within the ARP table so really for the purposes of the examination
we want to understand that the ARP command is going to show us IP address to MAC address bindings
for devices on our local network and we can use this command to display this information as well
as manually delete ARP information perhaps that information is stale and outdated we want to flush
it away or if we want to induce some corrective measures manually we can as we see here use the
dash S flag to set up a static ARP binding between a MAC address and an IP address and really that
is the focus of what we want to understand with respect to the ARP command. Okay dogs so I hope
this has been informative for you and I'd like to thank you for viewing.