Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about the differences between MAC and IP addresses, and why we need both of them.

To summarize, MAC addresses are physical unchangeable unique IDs for every single device while IP addresses are assigned, changeable and virtual. To analogize, MAC addresses are like people who have permanent names, and IP addresses are where they currently live.

In the real world, we link addresses and names with the help of a phonebook. What mechanism links IP addresses to MAC addresses and where is this mechanism located in the network?

share|improve this question
4  
After reviewing your questions, I think you'd benefit from a good book. Consider studying something along the lines of TCP/IP Illustrated, Vol. 1: The Protocols by Stevens (FYI, the 1993 edition is generally considered better than the 2011 re-release, although the 1993 edition only covers IPv4 in depth). – Mike Pennington Jun 26 '14 at 10:08
    
"The Illustrated Network: How TCP/IP Works in a Modern Network" and / or "TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference" might also be worth a look. – Jens Link Jun 26 '14 at 10:18
4  
@MikePennington Thank you, that is a nice way to word it, as opposed to a "RTFM" and a -1. I am reading it now online :) – CodyBugstein Jun 26 '14 at 10:21
    
Related: superuser.com/questions/623511/… – leonbloy Jun 26 '14 at 11:41
    
I think the question needs to be re-worded to "How are IP addresses associated with MAC addresses?" – Ahmet Cemil Sabır Jun 27 '14 at 12:52

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy).

To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all devices in the network), asking who has that IP address. The device with that IP address replies to the ARP (with its MAC address).

share|improve this answer
    
most of the time it just looks up from a local arp table I think. Just the first time it has to do a broadcast – Cruncher Jun 26 '14 at 13:46
    
^ yeah ofcourse, after it finds out the devices MAC, it stores in in an ARP table for some time (couple of minutes), so it doesn't have to repeat the ARP query process for each packet. – mulaz Jun 26 '14 at 14:03
    
Oh, I didn't realise that it dropped the table after a couple of minutes. I thought it held for a while. Does that mean to ARP poison, you need to send ARP responses quasi-frequently? – Cruncher Jun 26 '14 at 14:13
    
Yes, and the "real" host, must not send any packets to the poisoned machine, or the machine will store the 'real' MAC. – mulaz Jun 26 '14 at 14:17
1  
Depending on what you're trying to achieve. – mulaz Jun 26 '14 at 14:40

Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4.

To begin with, there is no such thing as ARPv6, and ARP itself cannot be used, because it was made for 4-byte network layer addresses (i.e. IPv4).

This part is taken up by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away, as is the custom with legacy IP. The NDP provides two message types that are of interest here: Neighbor Solicitation and Neighbor Advertisement. A node that wants to learn a link-layer address (note that while ARP is for IPv4->MAC, NDP can map IPv6 addresses to link-layer addresses of any type) for a particular IP address sends a Neighbor Solicitation to the according link-local solicited-node multicast address - there is no broadcast for IPv6 any more.

For example, if the address in question is 2001:db8::0011:2233:4455:6677, then the according solicited-node multicast address is ff02::1:ff55:6677, and the according ethernet multicast address is 33:33:ff:55:66:77. All nodes with an address ending on *55:6677 belong to that multicast group and will listen to that - this is most likely only the target system itself. The Neighbor Solicitation contains also the unicast IPv6 addresses and the MAC address of the soliciting system.

On receipt, the target node answers with its Neighbor Advertisement, which is sent to the unicast address (link layer and IPv6) of the soliciting node. Thus, the soliciting node learns the MAC-address of the target node.

And yes, NDP-spoofing works much like ARP-spoofing. And no, IPsec is not the answer.

share|improve this answer
    
"ARP itself cannot be used, because it was made for 4-byte network layer addresses (i.e. IPv4)." This is not true. ARP uses address length fields to specify the address length (up to 255 octets) for both the layer-2 and layer-3 addresses (see RFC 826). The reason ARP can't be used with IPv6 is because IPv6 doesn't have broadcast. – Ron Maupin Mar 29 at 2:09
1  
ARP was replaced with NDP in v6 for security reasons (and then, like all good v6-adjacent protocols, experienced significant feature creep), not because v6 doesn't have broadcast - ARP only uses L2 broadcast and easily could have been extended to provide v6 addresses. – Nick Bastin Mar 29 at 3:47
2  
I don't know if ARP was replaced for security reasons in the first place. As far as I see it there was the desire to cover all control protocols by ICMPv6. As a side effect, yes, you can secure ICMPv6 by IPsec. However, IPsec requires a key exchange, and IKE runs over UDP - which requires an IP address. One task of NDP is to negotiate an IP address, and manual key exchange does not scale, so the idea of NDP + IPsec = secure NDP does not work this way. Alternatives like SeND haven't lifted off (and likely never will). In the end I don't see any security advantage of NDP over ARP. – countermode Mar 30 at 6:38

The top answer is good. In case it helps, here's a description in terms of your phonebook analogy. Real networking terms in parentheses.

Based on their name (IP address) you know they live in your neighborhood (broadcast domain). First you look in your phonebook (ARP cache) to find their address if you already know their MAC (address). If they're not in the phonebook, you go outside and shout (broadcast), “Where does Steve live?” loud enough for everyone to hear (ARP request). Assuming Steve does in fact live there and he's awake, he replies—just to you, not shouting—“Here's my address” (ARP reply). You write it down in your phonebook for future reference (ARP caching).

share|improve this answer
    
Nicd thanks for sticking to the analogy – CodyBugstein Mar 29 at 20:24
    
Sure. It was a fun exercise for me. Real stuff like broadcast/unicast doesn't map perfectly on the analogy (shouting/talking/mail?), so take a grain of salt. – P1h3r1e3d13 Mar 29 at 20:26
  1. MAC addresses can be change. On Linux use ip or ifconfig for most Windows look at the driver settings of your network interface.

  2. You don't convert anything. MAC addresses are on Layer-2, IP on Layer-3 of the OSI model. For IPv4 ARP is used to find out which MAC (Layer-2) address belongs to a certain IP (Layer-3) address. For IPv6 ICMPv6 (Neighbor Discovery) is used.

share|improve this answer
    
Sorry, I should have said "translate" not "convert" – CodyBugstein Jun 26 '14 at 10:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.