Gratuitous ARP was created as a broadcast message which proactively
announces a system's IP and MAC addresses to the network.
As the name suggests,
computer send gratuitous ARP messages without being prompted by a request and
without any expectation of a response to the gratuitous ARP.
This happens because a device has some network card state change
important enough to alert the network of the change.
This means gratuitous ARP's function is to synchronize
the network by preloading other hosts ARP caches and
update switch MAC address tables.
The most common reasons a system would do this include when its NIC
comes up or gets connected to advertise an IP address recently
assigned to a machine or in failover redundancy scenarios where
network cards servicing an IP address has failed and another NIC takes
over using the same IP address, but at a different MAC or a different location.
NIC clustering, server clustering,
and router redundancy protocols all use gratuitous ARP.
A key difference in the packet details is the fact that a GARP
advertisement has both the sender and the target IP address is set
to the IP of the gratuitous ARP sender.
This is specifically what makes this a gratuitous ARP and
this is what lets receivers know they should use this
information to update their ARP caches.
Depending on the operating system,
the gratuitous ARP sender will either send a GARP request or a GARP reply,
not both.
Again, there is no expectation of a response to the gratuitous ARP,
both the GARP request and the GARP reply serve the same function to advertise
Mac and IP address information and update network systems.
Let's take a quick review of the normal ARP process.
ARP is used when a host has the IP address and needs to obtain
the associated MAC address for another host.
The host sends a broadcast ARP who has message request with
a target IP for which it needs resolution and the target
MAC address set to all zeros.
The broadcast ARP reaches everyone and only the host with the
target IP address responds with an ARP reply including its IP
address and MAC as the sender information.
The original requestor can then update its ARP cache.
The function of gratuitous ARP is to synchronize the network by preloading
other host ARP caches and update the switch MAC address tables.
The computer at IP1 and Mac A builds a GARP packet.
In this example,
the host is using the GARP request style as denoted by the opcode 1,
but what makes this a gratuitous ARP and not a regular ARP
is the fact that the sender and the target IP are both set
to the sender's IP address.
This broadcast frame arrives everywhere on the LAN along with
the switch updating the MAC address table,
all hosts update their respective ARP caches.
In some cases, a GARP reply is used,
but it serves the same function as the gratuitous ARP request.
Again,
the selection of GARP requests or reply is up to the
particular implementation of the operating system,
but most often,
I see these in routers which need to keep LAN devices
aware of the location of the gateway.
Although it has the opcode of the reply and the target is all Fs,
what makes this a gratuitous ARP is both the sender and the
target IP are the sender's IP address.
Once sent, the GARP performed its function updating ARP caches and Mac tables.
Now it's time to describe how gratuitous ARP plays a role in
solving the problem of single points of failure.
In this scenario, we have two important network resources,
the default-gateway router and some important server at IP 7 Mac D.
If the router fails, it's network card,
or cabling fail all hosts lose connectivity to
anything outside the local area network.
If the same happens at the server, of course,
any resources it has become wholly unavailable.
The solution is to create redundant resources.
Here,
we have two default-gateways acting as one unit generally
called first hop redundancy protocols.
There are three primary implementations,
Cisco's Hot Standby Router Protocol, HSRP,
the open standard version called Virtual Router Redundancy Protocol,
or VRRP, and Gateway Load Balancing, or GLBP.
For our discussion of gratuitous ARP, they all function basically the same,
to provide redundancy paths outside the local area network.
To do this,
they need a way to know which of the two is actively forwarding
data for hosts and advertise that to the network.
In this case, and in the upcoming demo, I'll use HSRP to describe.
Even though physical interfaces have their own MAC and IP
address depicted here as 2 and B and 3 and C,
HSRP routers share a common virtual IP and MAC address used to
service host needs as a default-gateway.
Messages between the routers make sure they're aware of which router is the
active router servicing hosts with the virtual IP and MAC.
Gratuitous ARPs are used to make sure the switches and hosts have the IP and
MAC information they need to forward data to the gateway.
Should the active router fail,
the redundant router will automatically take over servicing hosts.
Again,
gratuitous ARP updates switch MAC tables and hosts with the needed information.
Depending on the implementation, should the failed router recover,
it may take back over and use gratuitous ARP again to update the network.
You should note that the router physical interface IP and MAC addresses
will also be advertised if you add gratuitous ARP,
but it's not shown here.
Server NIC clustering works very similarly.
In this scenario, redundant servers are clustered and aware of each other.
If redundant servers are not available,
a little less redundancy can be provided using multiple
network cards on the same machine, however,
this only solves individual NIC or link failures and
doesn't cover the loss of an entire server.
In this example,
the cluster is configured to use IP address 7 and the primary server
uses a gratuitous ARP to alert hosts of the location.
Should the primary server fail,
the backup will use gratuitous ARP to make sure host ARP caches are updated
and the server services continue without interruption.
In some cases,
router and server redundancies also provide load
balancing of their services to the host.
They use an algorithm to regulate which device handles
responses for which hosts; however,
it does not effectively change how gratuitous ARP is used to handle
failover or updates and network synchronization.
Let's review.
Our traditional ARP functions to update a local machine's ARP cache.
It maps a known IP address to an unknown MAC address and it comes in
a call and response format using a request and a reply packet while
gratuitous ARP functions to synchronize the network hosts ARP caches
and Mac address tables.
Gratuitous ARP is used for host state network changes
and failover redundancy scenarios.
And finally,
gratuitous ARP comes in a request or reply style where both have the same job, but only one is sent and there is no expectation of a reply.