Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Ccna4-7 > Address Resolution - MODULO 9 > Flashcards

Address Resolution - MODULO 9 Flashcards

1
Q

MAC and IP
Destination on Same Network

A

Sometimes a host must send a message, but it only knows the IP address of the
destination device.
The host needs to know the MAC address of that device, but how can it be discovered?
That is where address resolution becomes critical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

There are two primary addresses assigned to a device on an Ethernet LAN:

A

Physical address (the MAC address) – Used for NIC to NIC communications on
the same Ethernet network.
* Logical address (the IP address) – Used to send the packet from the source
device to the destination device. The destination IP address may be on the same IP
network as the source or it may be on a remote network.
Layer 2 physical addresses (i.e., Ethernet MAC addresses) are used to deliver the data link
frame with the encapsulated IP packet from one NIC to another NIC that is on the same
network.
If the destination IP address is on the same network, the destination MAC address will be
that of the destination device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The Layer 2 Ethernet frame contains the following:

A

Destination MAC address – This is the simplified MAC address of PC2, 55-55-55.
* Source MAC address – This is the simplified MAC address of the Ethernet NIC on
PC1, aa-aa-aa.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The Layer 3 IP packet contains the following:

A

Source IPv4 address – This is the IPv4 address of PC1, 192.168.10.10.
* Destination IPv4 address – This is the IPv4 address of PC2, 192.168.10.11.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Destination on Remote Network

A

When the destination IP address (IPv4 or IPv6) is on a remote network, the destination
MAC address will be the address of the host default gateway (i.e., the router interface).
Consider the following example using a simplified MAC address representation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

example, PC1 wants to send a packet to PC2.

A

PC2 is located on remote network.
Because the destination IPv4 address is not on the same local network as PC1, the
destination MAC address is that of the local default gateway on the router.
Routers examine the destination IPv4 address to determine the best path to forward the
IPv4 packet.
When the router receives the Ethernet frame, it de-encapsulates the Layer 2 information.
Using the destination IPv4 address, it determines the next-hop device, and then
encapsulates the IPv4 packet in a new data link frame for the outgoing interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In our example, R1 would now encapsulate the packet with new Layer 2 address
information as shown in the figure.

A

The new destination MAC address would be that of the R2 G0/0/1 interface and the new
source MAC address would be that of the R1 G0/0/1 interface.
Along each link in a path, an IP packet is encapsulated in a frame.
The frame is specific to the data link technology that is associated with that link, such as
Ethernet.
If the next-hop device is the final destination, the destination MAC address will be that of
the device Ethernet NIC, as shown in the figure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ARP Overview

A

If your network is using the IPv4 communications protocol, the Address Resolution
Protocol, or ARP, is what you need to map IPv4 addresses to MAC addresses. This topic
explains how ARP works.
Every IP device on an Ethernet network has a unique Ethernet MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When a device sends an Ethernet Layer 2 frame, it contains these two addresses:

A
  • Destination MAC address - The Ethernet MAC address of the destination device
    on the same local network segment. If the destination host is on another network,
    then the destination address in the frame would be that of the default gateway (i.e.,
    router).
  • Source MAC address - The MAC address of the Ethernet NIC on the source host.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

To send a packet to another host on the same local IPv4 network

A

a host must know the
IPv4 address and the MAC address of the destination device.
Device destination IPv4 addresses are either known or resolved by device name.
However, MAC addresses must be discovered.
A device uses Address Resolution Protocol (ARP) to determine the destination MAC
address of a local device when it knows its IPv4 address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ARP provides two basic functions:

A
  • Resolving IPv4 addresses to MAC addresses
  • Maintaining a table of IPv4 to MAC address mappings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ARP Functions

A

When a packet is sent to the data link layer to be encapsulated into an Ethernet frame, the
device refers to a table in its memory to find the MAC address that is mapped to the IPv4
address.
This table is stored temporarily in RAM memory and called the ARP table or the ARP
cache.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The sending device will search its ARP table for a destination IPv4 address and a
corresponding MAC address.

A
  • If the packet’s destination IPv4 address is on the same network as the source IPv4
    address, the device will search the ARP table for the destination IPv4 address.
  • If the destination IPv4 address is on a different network than the source IPv4
    address, the device will search the ARP table for the IPv4 address of the default
    gateway.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In both cases

A

the search is for an IPv4 address and a corresponding MAC address for the
device.
Each entry, or row, of the ARP table binds an IPv4 address with a MAC address.
We call the relationship between the two values a map.
This simply means that you can locate an IPv4 address in the table and discover the
corresponding MAC address.
The ARP table temporarily saves (caches) the mapping for the devices on the LAN.
If the device locates the IPv4 address, its corresponding MAC address is used as the
destination MAC address in the frame.
If there is no entry is found, then the device sends an ARP request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ARP Request

A

An ARP request is sent when a device needs to determine the MAC address that is
associated with an IPv4 address, and it does not have an entry for the IPv4 address in its
ARP table.
ARP messages are encapsulated directly within an Ethernet frame.
There is no IPv4 header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The ARP request is encapsulated in an Ethernet frame using the following header
information:

A
  • Destination MAC address – This is a broadcast address FF-FF-FF-FF-FF-FF
    requiring all Ethernet NICs on the LAN to accept and process the ARP request.
  • Source MAC address – This is MAC address of the sender of the ARP request.
  • Type - ARP messages have a type field of 0x806. This informs the receiving NIC
    that the data portion of the frame needs to be passed to the ARP process.
17
Q

Because ARP requests are broadcasts

A

they are flooded out all ports by the switch, except
the receiving port.
All Ethernet NICs on the LAN process broadcasts and must deliver the ARP request to its
operating system for processing.
Every device must process the ARP request to see if the target IPv4 address matches its
own.
A router will not forward broadcasts out other interfaces.
Only one device on the LAN will have an IPv4 address that matches the target IPv4
address in the ARP request. All other devices will not reply.

18
Q

ARP Operation - ARP Reply

A

Only the device with the target IPv4 address associated with the ARP request will respond
with an ARP reply.

19
Q

The ARP reply is encapsulated in an Ethernet frame using the following header information:

A
  • Destination MAC address – This is the MAC address of the sender of the ARP
    request.
  • Source MAC address – This is the MAC address of the sender of the ARP reply.
  • Type - ARP messages have a type field of 0x806. This informs the receiving NIC
    that the data portion of the frame needs to be passed to the ARP process.
20
Q

Only the device that originally sent the ARP request will receive the unicast ARP reply.

A

After the ARP reply is received, the device will add the IPv4 address and the corresponding
MAC address to its ARP table.
Packets destined for that IPv4 address can now be encapsulated in frames using its
corresponding MAC address.
If no device responds to the ARP request, the packet is dropped because a frame cannot
be created.
Entries in the ARP table are time stamped.
If a device does not receive a frame from a particular device before the timestamp expires,
the entry for this device is removed from the ARP table.
Additionally, static map entries can be entered in an ARP table, but this is rarely done.
Static ARP table entries do not expire over time and must be manually removed.
Note: IPv6 uses a similar process to ARP for IPv4, known as ICMPv6 Neighbor Discovery
(ND). IPv6 uses neighbor solicitation and neighbor advertisement messages, similar to
IPv4 ARP requests and ARP replies.

21
Q

ARP Role in Remote
Communications

A

When the destination IPv4 address is not on the same network as the source IPv4 address,
the source device needs to send the frame to its default gateway.
This is the interface of the local router.
Whenever a source device has a packet with an IPv4 address on another network, it will
encapsulate that packet in a frame using the destination MAC address of the router.
The IPv4 address of the default gateway is stored in the IPv4 configuration of the hosts.
When a host creates a packet for a destination, it compares the destination IPv4 address
and its own IPv4 address to determine if the two IPv4 addresses are located on the same
Layer 3 network.
If the destination host is not on its same network, the source checks its ARP table for an
entry with the IPv4 address of the default gateway.
If there is not an entry, it uses the ARP process to determine a MAC address of the default
gateway.

22
Q

Removing Entries from an ARP Table

A

For each device, an ARP cache timer removes ARP entries that have not been used for a
specified period of time.
The times differ depending on the operating system of the device.
For example, newer Windows operating systems store ARP table entries between 15 and
45 seconds, as illustrated in the figure.

23
Q

ARP Issues - ARP Broadcasts and
ARP Spoofing

A

As a broadcast frame, an ARP request is received and processed by every device on the
local network.
On a typical business network, these broadcasts would probably have minimal impact on
network performance.
However, if a large number of devices were to be powered up and all start accessing
network services at the same time, there could be some reduction in performance for a
short period of time, as shown in the figure.
After the devices send out the initial ARP broadcasts and have learned the necessary MAC
addresses, any impact on the network will be minimized.

24
Q

In some cases, the use of ARP can lead to a potential security risk.

A

A threat actor can use ARP spoofing to perform an ARP poisoning attack.
This is a technique used by a threat actor to reply to an ARP request for an IPv4 address
that belongs to another device, such as the default gateway, as shown in the figure.
The threat actor sends an ARP reply with its own MAC address.
The receiver of the ARP reply will add the wrong MAC address to its ARP table and send
these packets to the threat actor.

25
Q

IPv6 Neighbor Discovery

A

If your network is using the IPv6 communications protocol, the Neighbor Discovery
protocol, or ND, is what you need to match IPv6 addresses to MAC addresses. This topic
explains how ND works.

26
Q

IPv6 Neighbor Discovery Messages

A

IPv6 Neighbor Discovery protocol is sometimes referred to as ND or NDP.
In this course, we will refer to it as ND.
ND provides address resolution, router discovery, and redirection services for IPv6 using
ICMPv6.

27
Q

ICMPv6 ND uses five ICMPv6 messages to perform these services:

A
  • Neighbor Solicitation messages
  • Neighbor Advertisement messages
  • Router Solicitation messages
  • Router Advertisement messages
  • Redirect Message
    Neighbor Solicitation and Neighbor Advertisement messages are used for device-to-device
    messaging such as address resolution (similar to ARP for IPv4). Devices include both host
    computers and routers.
28
Q

Router Solicitation and Router Advertisement

A

Router Solicitation and Router Advertisement messages are for messaging between
devices and routers. Typically router discovery is used for dynamic address allocation
and stateless address autoconfiguration (SLAAC).

29
Q

IPv6 Neighbor Discovery - Address
Resolution

A

Much like ARP for IPv4, IPv6 devices use IPv6 ND to determine the MAC address of a
device that has a a known IPv6 address.
ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages are used for MAC
address resolution.
This is similar to ARP Requests and ARP Replies used by ARP for IPv4.
For example, assume PC1 wants to ping PC2 at IPv6 address 2001:db8:acad::11.
To determine the MAC address for the known IPv6 address, PC1 sends an ICMPv6
Neighbor Solicitation message as illustrated in the figure.

30
Q

ICMPv6 Neighbor Solicitation messages

A

ICMPv6 Neighbor Solicitation messages are sent using special Ethernet and IPv6 multicast
addresses.
This allows the Ethernet NIC of the receiving device to determine whether the Neighbor
Solicitation message is for itself without having to send it to the operating system for
processing.
PC2 replies to the request with an ICMPv6 Neighbor Advertisement message which
includes its MAC address.

31
Q

MAC and IP

A

Layer 2 physical addresses (i.e., Ethernet MAC addresses) are used to deliver the data link
frame with the encapsulated IP packet from one NIC to another NIC on the same network.
If the destination IP address is on the same network, the destination MAC address will be
that of the destination device.
When the destination IP address (IPv4 or IPv6) is on a remote network, the destination
MAC address will be the address of the host default gateway (i.e., the router interface).
Along each link in a path, an IP packet is encapsulated in a frame.
The frame is specific to the data link technology associated that is associated with that link,
such as Ethernet.
If the next-hop device is the final destination, the destination MAC address will be that of
the device Ethernet NIC.
How are the IP addresses of the IP packets in a data flow associated with the MAC
addresses on each link along the path to the destination? For IPv4 packets, this is done
through a process called ARP. For IPv6 packets, the process is ICMPv6 ND.

32
Q

ARP

A

Every IP device on an Ethernet network has a unique Ethernet MAC address.
When a device sends an Ethernet Layer 2 frame, it contains these two addresses:
destination MAC address and source MAC address.
A device uses ARP to determine the destination MAC address of a local device when it
knows its IPv4 address.
ARP provides two basic functions: resolving IPv4 addresses to MAC addresses and
maintaining a table of IPv4 to MAC address mappings.
The ARP request is encapsulated in an Ethernet frame using this header information:
source and destination MAC addresses and type.
Only one device on the LAN will have an IPv4 address that matches the target IPv4
address in the ARP request.
All other devices will not reply.
The ARP reply contains the same header fields as the request.
Only the device that originally sent the ARP request will receive the unicast ARP reply.
After the ARP reply is received, the device will add the IPv4 address and the
corresponding MAC address to its ARP table.
When the destination IPv4 address is not on the same network as the source IPv4 address,
the source device needs to send the frame to its default gateway.
This is the interface of the local router.
For each device, an ARP cache timer removes ARP entries that have not been used for a
specified period of time.
Commands may also be used to manually remove some or all of the entries in the ARP
table.
As a broadcast frame, an ARP request is received and processed by every device on the
local network, which could cause the network to slow down.
A threat actor can use ARP spoofing to perform an ARP poisoning attack.

33
Q

Neighbor Discovery

A

IPv6 does not use ARP, it uses the ND protocol to resolve MAC addresses.
ND provides address resolution, router discovery, and redirection services for IPv6 using
ICMPv6.
ICMPv6 ND uses five ICMPv6 messages to perform these services: neighbor solicitation,
neighbor advertisement, router solicitation, router advertisement, and redirect.
Much like ARP for IPv4, IPv6 devices use IPv6 ND to resolve the MAC address of a device
to a known IPv6 address.

34
Q
A

Ccna4-7 (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions