18

I've been reading about the differences between MAC and IP addresses, and why we need both of them.

To summarize, MAC addresses are physical unchangeable unique IDs for every single device while IP addresses are assigned, changeable and virtual. To analogize, MAC addresses are like people who have permanent names, and IP addresses are where they currently live.

In the real world, we link addresses and names with the help of a phonebook. What mechanism links IP addresses to MAC addresses and where is this mechanism located in the network?

Improve this question
6
  • 6
    After reviewing your questions, I think you'd benefit from a good book. Consider studying something along the lines of TCP/IP Illustrated, Vol. 1: The Protocols by Stevens (FYI, the 1993 edition is generally considered better than the 2011 re-release, although the 1993 edition only covers IPv4 in depth).
    – Mike Pennington
    Commented Jun 26, 2014 at 10:08
  • "The Illustrated Network: How TCP/IP Works in a Modern Network" and / or "TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference" might also be worth a look.
    – user2084
    Commented Jun 26, 2014 at 10:18
  • 4
    @MikePennington Thank you, that is a nice way to word it, as opposed to a "RTFM" and a -1. I am reading it now online :)
    – CodyBugstein
    Commented Jun 26, 2014 at 10:21
  • Related: superuser.com/questions/623511/…
    – leonbloy
    Commented Jun 26, 2014 at 11:41
  • 2
    MAC addresses are, im reality, neither physical, nor unchangable, nor unique. I have seen devices that randomize their MAC at every reboot. There certainly are Utilities for just about any platform to temporarily or permanently change the MAC of nearly every interface. iOS 8 will even randomize the wifi MAC for scanning networks.
    – MacLemon
    Commented Jun 28, 2014 at 20:19

6 Answers 6

Reset to default
22

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy).

To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all devices in the network), asking who has that IP address. The device with that IP address replies to the ARP (with its MAC address).

Improve this answer
7
  • most of the time it just looks up from a local arp table I think. Just the first time it has to do a broadcast
    – Cruncher
    Commented Jun 26, 2014 at 13:46
  • ^ yeah ofcourse, after it finds out the devices MAC, it stores in in an ARP table for some time (couple of minutes), so it doesn't have to repeat the ARP query process for each packet.
    – mulaz
    Commented Jun 26, 2014 at 14:03
  • Oh, I didn't realise that it dropped the table after a couple of minutes. I thought it held for a while. Does that mean to ARP poison, you need to send ARP responses quasi-frequently?
    – Cruncher
    Commented Jun 26, 2014 at 14:13
  • Yes, and the "real" host, must not send any packets to the poisoned machine, or the machine will store the 'real' MAC.
    – mulaz
    Commented Jun 26, 2014 at 14:17
  • 1
    Depending on what you're trying to achieve.
    – mulaz
    Commented Jun 26, 2014 at 14:40
16

Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4.

To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses is done by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away, as is the custom with legacy IP. The NDP provides two message types that are of interest here: Neighbor Solicitation and Neighbor Advertisement. A node that wants to learn a link-layer address for a particular IP address sends a Neighbor Solicitation to the according link-local solicited-node multicast address - there is no broadcast for IPv6 any more.

For example, if the address in question is 2001:db8::0011:2233:4455:6677, then the according solicited-node multicast address is ff02::1:ff55:6677, and the according ethernet multicast address is 33:33:ff:55:66:77. All nodes with an address ending on *55:6677 belong to that multicast group and will listen to that - this is most likely only the target system itself. The Neighbor Solicitation contains also the unicast IPv6 addresses and the MAC address of the soliciting system.

On receipt, the target node answers with its Neighbor Advertisement, which is sent to the unicast address (link layer and IPv6) of the soliciting node. Thus, the soliciting node learns the MAC-address of the target node.

And yes, NDP-spoofing works much like ARP-spoofing. And no, IPsec is not the answer.

Improve this answer
3
  • "ARP itself cannot be used, because it was made for 4-byte network layer addresses (i.e. IPv4)." This is not true. ARP uses address length fields to specify the address length (up to 255 octets) for both the layer-2 and layer-3 addresses (see RFC 826). The reason ARP can't be used with IPv6 is because IPv6 doesn't have broadcast.
    – Ron Maupin ♦
    Commented Mar 29, 2016 at 2:09
  • 1
    ARP was replaced with NDP in v6 for security reasons (and then, like all good v6-adjacent protocols, experienced significant feature creep), not because v6 doesn't have broadcast - ARP only uses L2 broadcast and easily could have been extended to provide v6 addresses.
    – Nick Bastin
    Commented Mar 29, 2016 at 3:47
  • 2
    I don't know if ARP was replaced for security reasons in the first place. As far as I see it there was the desire to cover all control protocols by ICMPv6. As a side effect, yes, you can secure ICMPv6 by IPsec. However, IPsec requires a key exchange, and IKE runs over UDP - which requires an IP address. One task of NDP is to negotiate an IP address, and manual key exchange does not scale, so the idea of NDP + IPsec = secure NDP does not work this way. Alternatives like SeND haven't lifted off (and likely never will). In the end I don't see any security advantage of NDP over ARP.
    – countermode
    Commented Mar 30, 2016 at 6:38
4

The top answer is good. In case it helps, here's a description in terms of your phonebook analogy. Real networking terms in parentheses.

Based on their name (IP address) you know they live in your neighborhood (broadcast domain). First you look in your phonebook (ARP cache) to see if you already know their address (MAC address). If they're not in the phonebook, you go outside and shout (broadcast), “Where does Steve live?” loud enough for everyone to hear (ARP request). Assuming Steve does in fact live there and he's awake, he replies—just to you, not shouting—“Here's my address” (ARP reply). You write it down in your phonebook for future reference (ARP caching).

Improve this answer
2
  • Sure. It was a fun exercise for me. Real stuff like broadcast/unicast doesn't map perfectly on the analogy (shouting/talking/mail?), so take a grain of salt.
    – Jacktose
    Commented Mar 29, 2016 at 20:26
  • To editor: I used address later in the analogy, for MAC.
    – Jacktose
    Commented Dec 7, 2018 at 16:52
3

  1. MAC addresses can be change. On Linux use ip or ifconfig for most Windows look at the driver settings of your network interface.

  2. You don't convert anything. MAC addresses are on Layer-2, IP on Layer-3 of the OSI model. For IPv4 ARP is used to find out which MAC (Layer-2) address belongs to a certain IP (Layer-3) address. For IPv6 ICMPv6 (Neighbor Discovery) is used.

Improve this answer
1
  • Sorry, I should have said "translate" not "convert"
    – CodyBugstein
    Commented Jun 26, 2014 at 10:21
1

The network stack first looks up the destination IP in it's routing table, from this it determines two things.

  1. What interface the packet should be sent through.
  2. What the IP address of the next hop is. If no next hop is specified in the routing table the IP of the destination is used as the next hop.

Note that the next-hop IP address is a purely local concept, it never becomes part of a packet sent on the wire.

If the packet is to be sent out on a multipoint link layer (e.g. Ethernet etc), the OS then looks up the next hop in it's arp (ipv4) or neighbour discovery (ipv6) table. If it finds a non-stale entry there then it has the MAC address it needs and can send the packet.

If it doesn't have a usable entry it puts packets destined for that next-hop on hold and sends out a request to find the MAC address. The mechnisms here differ a bit between v4 and v6.

In v4 arp requests are sent. This is normally broadcast but in some cases if the host has a stale entry it may try a unicast request first and only fall back to broadcast if that fails. The reply is normally unicast.

In v6 neigbour solicitation requests are sent to a multicast address generated from the next hop address. The target replies with a unicast neighbour advertisement. Hosts can also send neighbour advertisements to the "all-nodes multicast" (aka effectively broadcast) group to refresh entries in their peers neighbour discovery caches.

Improve this answer
0

Address Resolution Protocol (ARP)

IP Address ---> ARP ---> MAC Address

MAC Address ---> RARP ---> IP Address

IP Address = Logical Address [ 32 bits ]

MAC Address = Physical Address [ 48 bits ]

Network Layer (IP)----> ARP ---> Data Link Layer(MAC)

IP Address is needed in Network Layer to identify a Source/Destination Host.

MAC Address is needed in Data Link Layer to identify a Source/Destination Host.

Improve this answer
1
  • You are incorrect about RARP (many people have this incorrect idea). This is something that used to be used by a host to determine its own IP address, not the IP addresses of other hosts. It is no longer used.
    – Ron Maupin ♦
    Commented Sep 8, 2017 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.