9 - Address Resolution
What two protocols are used to determine the MAC address of a known destination device IP address (IPv4 and IPv6)?
ARP ND
Which statement is true about ARP?
ARP entries are cached temporarily
What is an attack using ARP?
ARP poisoning
Every IP device on an Ethernet network has a unique Ethernet MAC address. When a device sends an Ethernet Layer 2 frame, it contains these two addresses:
Destination MAC address - The Ethernet MAC address of the destination device on the same local network segment. If the destination host is on another network, then the destination address in the frame would be that of the default gateway (i.e., router). Source MAC address - The MAC address of the Ethernet NIC on the source host.
ARP messages are encapsulated directly within an Ethernet frame. There is no IPv4 header. The ARP request is encapsulated in an Ethernet frame using the following header information:
Destination MAC address - This is a broadcast address FF-FF-FF-FF-FF-FF requiring all Ethernet NICs on the LAN to accept and process the ARP request. Source MAC address - This is MAC address of the sender of the ARP request. Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.
Only the device with the target IPv4 address associated with the ARP request will respond with an ARP reply. The ARP reply is encapsulated in an Ethernet frame using the following header information:
Destination MAC address - This is the MAC address of the sender of the ARP request. Source MAC address - This is the MAC address of the sender of the ARP reply. Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.
The Layer 2 Ethernet frame contains
Destination MAC address - This is the simplified MAC address of PC2, 55-55-55 Source MAC address - This is the simplified MAC address of the Ethernet NIC on PC1, aa-aa-aa
Which destination address is used in an ARP request frame?
FFFF.FFFF.FFFF Topic 9.2.0 - The purpose of an ARP request is to find the MAC address of the destination host on an Ethernet LAN. The ARP process sends a Layer 2 broadcast to all devices on the Ethernet LAN. The frame contains the IP address of the destination and the broadcast MAC address, FFFF.FFFF.FFFF.
What type of information is contained in an ARP table?
IPv4 address to MAC address mappings. Topic 9.2.0 - ARP tables are used to store mappings of IPv4 addresses to MAC addresses. When a network device needs to forward a packet, the device knows only the IPv4 address. To deliver the packet on an Ethernet network, a MAC address is needed. ARP resolves the MAC address and stores it in an ARP table.
What addresses are mapped by ARP?
IPv4 address to a destination MAC address Topic 9.2.0 - ARP, or the Address Resolution Protocol, works by mapping the IPv4 address to a destination MAC address. The host knows the destination IPv4 address and uses ARP to resolve the corresponding destination MAC address.
What will a Layer 2 switch do when the destination MAC address of a received frame is not in the MAC table?
It forwards the frame out of all ports except for the port at which the frame was received. Topic 9.2.0 - A Layer 2 switch determines how to handle incoming frames by using its MAC address table. When an incoming frame contains a destination MAC address that is not in the table, the switch forwards the frame out all ports, except for the port on which it was received.
Which action is taken by a Layer 2 switch when it receives a Layer 2 broadcast frame?
It sends the frame to all ports except the port on which it received the frame. Topic 9.2.0 - When a Layer 2 switch receives a frame with a broadcast destination address, it floods the frame to all ports except the port on which it received the frame.
The ARP table in a switch maps which two types of address together?
Layer 3 address to a Layer 2 address Topic 9.2.0 - The switch ARP table keeps a mapping of Layer 2 MAC addresses to Layer 3 IP addresses. These mappings can be learned by the switch dynamically through ARP or statically through manual configuration.
What two functions are provided by ARP? (Choose two.)
Maintains a table of IPv4 address to domain names Resolves IPv4 addresses to MAC addresses
Which two ICMPv6 messages are used in to determine the MAC address of a known IPv6 address?
Neighbor advertisement Neighbor Solicitation
Where is the ARP table stored on a device?
RAM
Which router component holds the routing table, ARP cache, and running configuration file?
RAM Topic 9.2.0 - The routing table, ARP cache, and running configuration file are stored in volatile RAM.
Which two ICMPv6 messages are used in SLAAC?
Router Advertisement Router Solicitation
Which two ICMPv6 messages are used during the Ethernet MAC address resolution process? (Choose two.)
Router Solicitation Neighbor Advertisement Topic 9.3.0 - IPv6 uses neighbor solicitation (NS) and neighbor advertisement (NA) ICMPv6 messages for MAC address resolution.
The Layer 3 IP packet contains the following:
Source IPv4 address - This is the IPv4 address of PC1, 192.168.10.10 Destination IPv4 address - This is the IPv4 address of PC2, 192.168.10.11
What destination MAC address would be included in a frame sent from a source device to a destination device on the same local network?
The MAC address of the destination device.
What destination MAC address would be included in a frame sent from a source device to a destination device on a remote local network?
The MAC address of the local router interface.
A PC is configured to obtain an IPv4 address automatically from network 192.168.1.0/24. The network administrator issues the arp -a command and notices an entry of 192.168.1.255 ff-ff-ff-ff-ff-ff. Which statement describes this entry?
This is a static map entry. Topic 9.2.0 - The IPv4 address of 192.168.1.255 on the 192.168.1.0/24 network is the broadcast address, which is statically mapped to ff-ff-ff-ff-ff-ff in the ARP table.
Physical address (the MAC address)
Used for NIC to NIC communications on the same Ethernet network.
Logical address (the IP address)
Used to send the packet from the source device to the destination device. The destination IP address may be on the same IP network as the source or it may be on a remote network.
A cybersecurity analyst believes an attacker is spoofing the MAC address of the default gateway to perform a man-in-the-middle attack. Which command should the analyst use to view the MAC address a host is using to reach the default gateway?
arp -a Topic 9.2.0 - ARP is a protocol used with IPv4 to map a MAC address to an associated specific IP address. The command arp -a will display the MAC address table on a Windows PC.
arp -a
command is used to display the ARP table on Windows
To what type of address are ICMPv6 neighbor solicitation messages sent?
multicast
What is one function of the ARP protocol?
resolving an IPv4 address to a MAC address Topic 9.2.0 - The two main functions of the ARP protocol are to resolve an IPv4 address to a MAC address and to maintain an ARP table, which lists the resolved pairs of IPv4 address and MAC address. A device automatically obtains an IP address through DHCP. The functions of DNS include resolving (or mapping) a domain name with its IP address and maintaining a table for the domain name/IP pairs.
Which command could be used on a Cisco router to view its ARP table?
show ip arp
When an IPv4 packet is sent to a host on a remote network, what information is provided by ARP?
the MAC address of the router interface closest to the sending host Topic 9.1.0 - When a host sends an IPv4 packet to a destination on a different network, the Ethernet frame cannot be sent directly to the destination host because the host is not directly reachable in the same network. The Ethernet frame must be sent to another device known as the router or default gateway in order to forward the IPv4 packet. ARP is used to discover the MAC address of the router (or default gateway) and use it as the destination MAC address in the frame header.
How does the ARP process use an IPv4 address?
to determine the MAC address of a device on the same network Topic 9.1.0 - The ARP process is used to complete the necessary mapping of IPv4 and MAC addresses that are stored in the ARP table that is maintained by each node on a LAN. When the destination device is not on the same network as the source device, the MAC address of the Layer 3 device on the the source network is discovered and added to the ARP table of the source node.
What is the purpose of ARP in an IPv4 network?
to obtain a specific MAC address when an IP address is known Topic 9.2.0 - ARP performs two functions: - To obtain a specific MAC address when an IP address is known, by broadcasting an ARP request message to all devices on a particular Ethernet network - To use the gathered information to create a viewable table of IP address to MAC address mappings
show ip arp
used to display the ARP table on a Cisco router