ARP (Address Resolution Protocol) finds the MAC (physical) address for a known IP address; RARP (Reverse ARP) finds the IP address for a known MAC address.
ARP
- Used when a host knows the destination's IP address (on the same LAN, or the default gateway's IP) but needs its MAC address to build the Ethernet frame.
- Steps:
- The host checks its ARP cache.
- If not found, it broadcasts an ARP request (destination MAC FF:FF:FF:FF:FF:FF): "Who has IP 192.168.1.5? Tell 192.168.1.2."
- All hosts receive it; only the owner of that IP replies with a unicast ARP reply containing its MAC address.
- The sender stores the IP–MAC pair in its ARP cache (for a limited time) and sends the frame.
- Variants: proxy ARP (a router answers for hosts on another network), gratuitous ARP (a host announces its own IP–MAC mapping, e.g. to detect duplicate IPs).
- Security issue: ARP spoofing/poisoning, since replies are not authenticated.
RARP
- Used by diskless workstations that know only their MAC address (from the network card) at boot time and need an IP address.
- The machine broadcasts a RARP request with its MAC address; a RARP server on the LAN looks it up in its table and replies with the IP address.
- Limitations: needs a RARP server on every network segment (broadcasts are not routed), gives only an IP address (no subnet mask, gateway, etc.). It has been replaced by BOOTP and then DHCP.
| ARP | RARP |
|---|---|
| IP → MAC | MAC → IP |
| Used by any host before sending a frame | Used by diskless hosts at boot |
| Reply from the target host | Reply from a RARP server |
| Still widely used (IPv4) | Obsolete, replaced by DHCP |
Both work between the network layer and the data link layer. In IPv6, ARP's job is done by the Neighbor Discovery Protocol.