🌐 Phase 3 · Network Layer 🟡 Intermediate MODULE 09

Address Resolution

⏱️ 2.5 hours

📖 Theory + Code

🧩 10 Questions

🔬 Phase 3 · Module 9

CCNA Module 9 progress0%

🎯 What you'll learn: Why we need both IP and MAC addresses, ARP (Address Resolution Protocol) operation for IPv4, ARP issues (broadcasts and spoofing), and IPv6 Neighbor Discovery (NDP) which replaces ARP for IPv6.

Section 1

Why Both IP and MAC?

Two different address types work together to deliver data across a network:

IP address (Layer 3): logical, software-assigned, identifies network location end-to-end. Stays constant as a packet travels across the entire internet.
MAC address (Layer 2): physical, hardware-assigned (burned into the NIC), identifies the device on its local segment only. Changes at every router hop.

The reason we need both: IP addresses are used for routing across networks (they never change end-to-end), while MAC addresses are used for delivery on the local segment (they change at each hop as the frame is re-encapsulated).

📦 How Addresses Change Across Hops

Segment	Src MAC	Dst MAC	Src IP	Dst IP
PC1 → Router (LAN)	PC1 MAC	Router LAN MAC	192.168.1.10	8.8.8.8
Router → Server (WAN)	Router WAN MAC	Server MAC	192.168.1.10	8.8.8.8

IP addresses (source and destination) remain constant end-to-end. MAC addresses change at every router hop.

💡

Key exam concept: MAC vs IP scope

MAC addresses are local — they have meaning only on the current network segment (broadcast domain). Switches use MACs to forward frames. IP addresses are global — they remain constant end-to-end through all routers. Routers re-encapsulate frames with new L2 addresses at each hop but never change the L3 IP addresses (except NAT).

Section 2

ARP Overview

ARP (Address Resolution Protocol, RFC 826) maps a known IPv4 address to an unknown MAC address on the local network. When a host needs to send a frame but only knows the destination IP address, it uses ARP to discover the corresponding MAC address.

L2/L3

ARP bridges Layer 2 and Layer 3

RFC
826

Defined in 1982 — still used today

Dyn

Dynamic entries learned via ARP

arp -a

Windows command to view ARP cache

ARP Table (Cache): a temporary store of recently resolved IP-to-MAC mappings. Entries are time-limited and refreshed automatically.
Dynamic entries: learned through ARP request/reply exchanges
Static entries: manually configured — persistent, used for critical devices

Section 3

ARP Operation — Request and Reply

ARP works in two steps: a broadcast request asking "who has this IP?" followed by a unicast reply from the device that owns that IP:

🔍 ARP Operation Flow

PC1 wants to reach 192.168.1.1 — ARP cache empty

↓

PC1 sends ARP Request (Broadcast FF:FF:FF:FF:FF:FF)
"Who has 192.168.1.1? Tell 192.168.1.10"

↓

Other devices receive it
but ignore (not their IP)

Router (192.168.1.1) responds
ARP Reply (Unicast to PC1)
"I have 192.168.1.1, MAC = AA:BB:CC:..."

↓

PC1 stores result in ARP cache → sends frame to router's MAC

ARP in action — Windows and Cisco

IOS + OS

! PC1 wants to ping 192.168.1.1 (gateway)
! PC1's ARP cache is empty initially
C:\> arp -a
Interface: 192.168.1.10
  Internet Address   Physical Address   Type
  (empty)

! PC1 broadcasts ARP request: "Who has 192.168.1.1?"
! Router replies: "I do, my MAC is 00:1A:2B:3C:4D:5E"
! PC1 caches the result — subsequent packets skip ARP
C:\> arp -a
  192.168.1.1        00-1A-2B-3C-4D-5E   dynamic

! On Cisco router — view ARP table
R1# show arp
Protocol  Address      Age(min)  Hardware Addr    Type  Interface
Internet  192.168.1.1  -         0019.e81a.b700   ARPA  Gig0/0 (router's own)
Internet  192.168.1.10 3         0050.56b1.2345   ARPA  Gig0/0 (PC1)

✨

ARP Request = Broadcast. ARP Reply = Unicast.

This is a very common exam question. The ARP Request is sent as a broadcast (destination MAC FF:FF:FF:FF:FF:FF) because the sender doesn't yet know the target's MAC. Every device on the segment receives and examines it, but only the owner of that IP responds. The ARP Reply is sent as a unicast directly back to the requester — no need to involve all other devices again.

Section 4

ARP Issues

ARP has two significant problems in production networks:

ARP Broadcasts

Bandwidth Overhead

Every unknown destination triggers an ARP broadcast. In large networks with thousands of hosts, this creates significant overhead. ARP is limited to the broadcast domain — switches don't forward broadcasts between VLANs.

ARP Spoofing

Man-in-the-Middle Attack

An attacker sends gratuitous ARP replies: "I have the gateway IP, use my MAC." Victims update their ARP cache with the wrong MAC. All traffic flows to the attacker instead of the gateway.

Dynamic ARP Inspection

DAI — Defence

Cisco switch feature that validates ARP packets against the DHCP snooping binding table. Untrusted ports (end devices) cannot send ARP replies for IPs they don't own.

⚠️

ARP Spoofing — one of the most dangerous LAN attacks

An attacker can silently intercept, modify, or drop all traffic between victims without either side knowing. Because ARP has no authentication, any device can claim to be any IP. Defence: Enable Dynamic ARP Inspection (DAI) on Cisco switches. DAI validates ARP replies against the DHCP snooping database — if the MAC/IP pair doesn't match what DHCP assigned, the packet is dropped. Command: ip arp inspection vlan [vlan-id]

ARP verification and Dynamic ARP Inspection

Cisco IOS

! Check ARP table on switch
SW1# show arp
Protocol  Address      Age(min)  Hardware Addr    Type  Interface
Internet  192.168.1.1  0         0019.e81a.b700   ARPA  Vlan1
Internet  192.168.1.10 5         0050.56b1.2345   ARPA  Vlan1

! Clear ARP cache on Cisco device
SW1# clear arp-cache

! Clear ARP on Windows
C:\> arp -d *

! Enable Dynamic ARP Inspection (DAI) — defends against ARP spoofing
SW1(config)# ip arp inspection vlan 1      ! Enable DAI for VLAN 1
SW1(config)# interface FastEthernet 0/1       ! Uplink/trunk port
SW1(config-if)# ip arp inspection trust        ! Trust this port (router/uplink)
! Ports NOT trusted will have ARP replies validated — end-device ports

Section 5

IPv6 Neighbor Discovery (NDP)

IPv6 does not use ARP. Instead it uses the Neighbor Discovery Protocol (NDP), which is part of ICMPv6 (Internet Control Message Protocol version 6). NDP is more efficient and more secure than ARP because it uses multicast instead of broadcast.

NDP uses four ICMPv6 message types:

Type 133 — RS

Router Solicitation

Sent by a host when it comes online: "Are there any routers on this network?" Routers respond with an RA.

Type 134 — RA

Router Advertisement

Sent by routers periodically (or in response to RS): "I am a router, here is the prefix and gateway info." Used for SLAAC (Stateless Address Autoconfiguration).

Type 135 — NS

Neighbor Solicitation

"Who has this IPv6 address?" — equivalent to ARP Request. Sent to the solicited-node multicast address (FF02::1:FFxx:xxxx) of the target.

Type 136 — NA

Neighbor Advertisement

"I have this IPv6 address, my MAC is..." — equivalent to ARP Reply. Sent as unicast back to the requester (or multicast to all nodes).

Solicited-Node Multicast

Efficient Targeting

NS is sent to FF02::1:FFxx:xxxx where xx:xxxx = last 24 bits of target IPv6 address. Only ~1/16M hosts receive it vs ALL hosts for ARP broadcast.

NDP States

Reachability

INCOMPLETE → REACHABLE → STALE → DELAY → PROBE. REACHABLE = two-way communication recently confirmed. STALE = entry exists but not recently verified.

IPv6 Neighbor Discovery — Cisco verification

Cisco IOS

! View IPv6 neighbor table (equivalent of IPv4 ARP table)
R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State   Interface
FE80::1A2B:3C4D:5E6F:7890               0   0050.56b1.1234  REACH   Gig0/0
2001:DB8::1                              2   0050.56b1.1234  STALE   Gig0/0

! NDP States explained:
! INCOMPLETE  = NS sent, waiting for NA reply
! REACHABLE   = confirmed two-way reachability (freshly confirmed)
! STALE       = entry exists but not recently confirmed (still usable)
! DELAY       = in delay period before sending probe
! PROBE       = sending NS probes to verify reachability

💡

NDP replaces multiple IPv4 protocols at once

IPv6 NDP (via ICMPv6 RS/RA/NS/NA messages) replaces: ARP (address resolution), RARP (reverse ARP), ICMP Router Discovery (finding routers), and ICMP Redirect. It also adds new functions like SLAAC (address autoconfiguration) and DAD (Duplicate Address Detection). NDP is more secure because it uses multicast (not broadcast) and can be secured with SEcure Neighbor Discovery (SEND).

🧩 Knowledge Check

10 questions — Address Resolution

1. ARP operates at which layer?

2. An ARP Request is sent as a:

3. An ARP Reply is sent as a:

4. Which command shows the ARP table on a Windows PC?

5. ARP Spoofing allows an attacker to:

6. What does NDP replace in IPv6?

7. Which NDP message type is similar to an ARP Request?

8. ARP entries are stored in:

9. What is the main advantage of NDP over ARP?

10. Which command clears the ARP cache on a Cisco device?

Finished this module?

Mark it complete to track your progress.

Phase 3 · Network LayerModule 9 of 17