ARP(4)

💖 ARP 💖

okay bestie, gather round, because we're about to talk about the Address Resolution Protocol — that's arp for short, and she's a kernel interfaces manual girlie. no cap. 🦋

---

✨ SYNOPSIS ✨

device ether

that's it. that's the whole vibe. one line. iconic. 💅

---

🌸 DESCRIPTION 🌸

so like — the Address Resolution Protocol (ARP) is what maps between Protocol Addresses (think IP addresses) and Local Network Addresses (think Ethernet addresses). dynamically. on the fly. no manual labor. and this particular implementation maps IP addresses to Ethernet, ARCnet, or Token Ring addresses, and literally every Ethernet interface driver uses it. all of them. she's everywhere. 👑

ARP caches Internet-Ethernet address mappings. here's the tea ☕: when an interface asks for a mapping to an address that is not in the cache, ARP queues the message that needs the mapping and broadcasts a message on the associated network asking for the address mapping. if a response comes back, the new mapping gets cached and the pending message gets transmitted. and here's the catch — ARP will queue at most one packet while it waits for a response to a mapping request; only the most recently "transmitted" packet is kept. only one, bestie. don't @ her.

if the target host does not respond after several requests, the host is considered to be down, which lets an error be returned to transmission attempts. further demand for this mapping causes ARP request retransmissions, which are ratelimited to one packet per second. and the errors you get are: EHOSTDOWN for a non-responding destination host, and EHOSTUNREACH for a non-responding router. 💀

the ARP cache lives in the system routing table as dynamically-created host routes. the route to a directly-attached Ethernet network is installed as a "cloning" route (one with the RTF_CLONING flag set), which makes routes to individual hosts on that network get created on demand. these routes time out periodically — normally 20 minutes after validated; entries are not validated when not in use.

ARP entries can be added, deleted or changed with the arp(8) utility. manually-added entries may be temporary or permanent, and may be "published" — in which case the system will respond to ARP requests for that host as if it were the target of the request. main character energy, honestly. ✨

in the past, ARP was used to negotiate the use of a trailer encapsulation. this is no longer supported. rip to that era. 🪦

ARP watches passively for hosts impersonating the local host — i.e., a host that responds to an ARP mapping request for the local host's address. she's always watching. 👀

Proxy ARP is a feature where the local host responds to requests for addresses other than itself, using its own address. normally, proxy ARP in FreeBSD is set up host-by-host using the arp(8) utility, by adding an entry for each host inside a given subnet for which proxying of ARP requests is desired. however — the "proxy all" feature makes the local host act as a proxy for all hosts reachable through some other network interface, different from the one the request came in from. you enable it by setting the sysctl(8) MIB variable net.link.ether.inet.proxyall to 1. slay. 🌈

---

🎀 MIB Variables 🎀

the ARP protocol implements a bunch of configurable variables in the net.link.ether.inet branch of the sysctl(3) MIB. let's go one by one, bestie:

• allow_multicast — install ARP entries with the multicast bit set in the hardware address. installing such entries is an RFC 1812 violation, but some proprietary load balancing techniques require routers to do so. turned off by default.
• garp_rexmit_count — retransmit gratuitous ARP (GARP) packets when an IPv4 address is added to an interface. a GARP is always transmitted when an IPv4 address is added to an interface. a non-zero value causes the GARP packet to be retransmitted the stated number of times. the interval between retransmissions is doubled each time, so the retransmission intervals are: {1, 2, 4, 8, 16, ...} (seconds). the default value of zero means only the initial GARP is sent; no additional GARP packets are retransmitted. the maximum value is sixteen.

the default behavior of a single GARP packet is usually sufficient. however, a single GARP might be dropped or lost in some circumstances. this is particularly harmful when a shared address is passed between cluster nodes. neighbors on the network link might then work with a stale ARP cache and send packets destined for that address to the node that previously owned the address, which might not respond. 😭

• log_arp_movements — log movements of IP addresses from one hardware address to another. see "DIAGNOSTICS" below. turned on by default.
• log_arp_permanent_modify — log attempts by a remote host to modify a permanent ARP entry. see "DIAGNOSTICS" below. turned on by default.
• log_arp_wrong_iface — log attempts to insert an ARP entry on an interface when the IP network to which the address belongs is connected to another interface. see "DIAGNOSTICS" below. turned on by default.
• max_log_per_second — limit the number of remotely triggered logging events to a configured value per second. default is 1 log message per second.
• max_age — how long an ARP entry is held in the cache until it needs to be refreshed. default is 1200 seconds.
• maxhold — how many packets to hold in the per-entry output queue while the entry is being resolved. default is one packet.
• maxtries — number of retransmits before a host is considered down and an error is returned. default is 5 tries.
• proxyall — enables ARP proxying. turned off by default.
• wait — lifetime of an incomplete ARP entry. default is 20 seconds.

---

🔥 DIAGNOSTICS 🔥

these are the messages you might see, and what they mean. pay attention bestie, this is the good part:

• arp: %x:%x:%x:%x:%x:%x is using my IP address %d.%d.%d.%d on %s! — ARP has discovered another host on the local network which responds to mapping requests for its own Internet address with a different Ethernet address, generally indicating that two hosts are attempting to use the same Internet address.
• arp: link address is broadcast for IP address %d.%d.%d.%d! — ARP requested information for a host, and received an answer indicating that the host's ethernet address is the ethernet broadcast address. this indicates a misconfigured or broken device. 🙈
• arp: %d.%d.%d.%d moved from %x:%x:%x:%x:%x:%x to %x:%x:%x:%x:%x:%x on %s — ARP had a cached value for the ethernet address of the referenced host, but received a reply indicating that the host is at a new address. this can happen normally when host hardware addresses change, or when a mobile node arrives or leaves the local subnet. it can also indicate a problem with proxy ARP. this message can only be issued if the sysctl net.link.ether.inet.log_arp_movements is set to 1, which is the system's default behaviour.
• arpresolve: can't allocate llinfo for %d.%d.%d.%d — the route for the referenced host points to a device upon which ARP is required, but ARP was unable to allocate a routing table entry in which to store the host's MAC address. this usually points to a misconfigured routing table. it can also occur if the kernel cannot allocate memory.
• arp: %d.%d.%d.%d is on if0 but got reply from %x:%x:%x:%x:%x:%x on if1 — physical connections exist to the same logical IP network on both if0 and if1. it can also occur if an entry already exists in the ARP cache for the IP address above, and the cable has been disconnected from if0, then reconnected to if1. this message can only be issued if the sysctl net.link.ether.inet.log_arp_wrong_iface is set to 1, which is the system's default behaviour.
• arp: %x:%x:%x:%x:%x:%x attempts to modify permanent entry for %d.%d.%d.%d on %s — ARP has received an ARP reply that attempts to overwrite a permanent entry in the local ARP table. this error will only be logged if the sysctl net.link.ether.inet.log_arp_permanent_modify is set to 1, which is the system's default behaviour.
• arp: %x:%x:%x:%x:%x:%x is multicast — kernel refused to install an entry with multicast hardware address. if you really want such addresses being installed, set the sysctl net.link.ether.inet.allow_multicast to a positive value.

---

🌟 SEE ALSO 🌟

• inet(4)
• route(4)
• arp(8)
• ifconfig(8)
• route(8)
• sysctl(8)
• Plummer, D., "RFC826", An Ethernet Address Resolution Protocol.
• Leffler, S.J. and Karels, M.J., "RFC893", Trailer Encapsulations.

---

and that's the whole page, bestie!! 🫶 this one came from the Debian crew, dated October 7, 2016 — so yeah, she's a lil vintage but she still serves. 💜 go forth and resolve some addresses. mwah. 💋