Welcome to this demonstration on ARP's function in
duplicate IP address detection.
I'll use Wireshark captures to show you the process and packet details
used when systems are configured with a new IP address.
First,
we'll look at what happens when there is no IP conflict on the
LAN and the assigned IP address is accepted.
Next,
you will see the process hosts go through in the event of an
IP conflict and learn what the results are.
We'll begin by starting our Wireshark capture.
Start it on my interface, and I'll add an ARP visual filter.
Now the easiest way to see the process our host goes through and the
packets it generates for duplicate IP address detection is to simply
put a static IP address on its interface.
I'll open up its interface and change its IP
address to something I know is free.
In this case, I'll put in a static address of 20.
1.
37 with the mask of 255.
255.
255 to match our LAN, and the default-gateway IP address of 20.
1.
I'll click OK and click OK again.
Immediately, our host goes through the duplicate IP address detection process.
Let's look in our Wireshark.
The duplicate IP address detection process is made up of 3 packets,
in this case, packet 160, 167,
and 169 and concludes with 172 where the host has accepted
the IP address assignment and is announcing to the network
its IP and MAC address information.
Let's take a look at the first three broadcasts.
If we look in the packet details,
the frame is clearly a broadcast coming from the VMware network card.
Although this looks like a standard address resolution protocol request,
if we look in the header details,
we can see that this duplicate IP address detection ARP doesn't match the
format of any other ARP including the gratuitous ARP.
The center MAC is naturally the MAC address of the system
on which I just set the IP address.
Setting the center IP address and the target MAC address to all zeros,
alerts all hosts on the network that this is a duplicate IP
address detection ARP and it prevents them from updating their
ARP cache with false information.
And finally, the target IP address 20.
1.
37 is the 1 that's been assigned to the host and gives other hosts a chance to
respond if they already have this IP address configured.
Now you'll notice,
two other broadcasts with the same information have
been sent out in quick succession.
This repetition helps the duplicate IP address process deal
with congestion or packet loss on the LAN.
If after 3 tries no system speaks up that they're using the address 20.
1.
37, my system will accept that IP address and send out a gratuitous ARP for 20.
1.
37, and as a gratuitous ARP,
we can see the sender IP address and the target IP address
set to the newly assigned IP address of 20.
1.
37.
This gratuitous ARP notifies everyone on the LAN of the IP
address assignment and allows them to update their ARP caches
and any switch MAC address tables.
Now let's see what happens when there is an IP address conflict.
I'm going to stop my capture and start a new one.
This time,
I'll set an IP address on my interface to something
that already exists in the LAN.
Instead of using 20.
1.
37, I'll set the IP address to 20.
1.
100, which is the IP address of a switch in my network.
I'll set the default-gateway, click OK, and click OK.
I'm going to stop my capture and let's take a look at what happened.
My duplicate IP address detection process started with packet 71.
As soon as I set the IP address 20.
1.
100 on my network card, this ARP request was sent out.
We can see the exact same format we saw before,
the sender MAC address is my VMware network card,
the sender IP address and the target MAC address are set to all zeros,
again,
showing this as a duplicate IP address detection method and making
sure other hosts don't update their ARP caches,
and the target IP address is set to 20.
1.
100 telling other hosts to speak up if they already
have that IP address assigned.
Our next packet is the consequence of the conflict.
Notice that this is a directed ARP reply coming from the Cisco switch
and going directly back to the VMware network card.
In the ARP header, we can see the opcode 2 meaning it's a reply,
but because it's an IP conflict, the sender IP address is set to the 20.
1.
100 and the target IP address is set to 0.
0.
In this way,
the Cisco switch is letting the VMware network card know
that the IP address is already in use.
Because of the IP address conflict,
my network card is trying to set its IP address to the 169.
254.
77.
23 address.
This is an APIPA, or Automatic Private IP Address assignment,
and because it's an assignment, just like DHCP or static,
the network card still has to go through the
duplicate IP address detection process, and therefore,
generates this broadcast with the same format.
If you notice the target IP address is 169.
254.
77.
23 and the sender IP address and target MAC address are both set to all zeros.
My system is going to do this three times,
and if nobody else has that APIPA address,
my system is going to self-assign it and send out an ARP request.
In this case,
it's a gratuitous ARP letting everyone on the network know
that my machine has accepted the address 169.
254.
77.
23 and to update their ARP caches.
Now of course,
this IP address is going to do my machine no good for
communication on this local area network,
but the ARP duplicate IP address detection process has
successfully negotiated when there is a conflict,
the machine has changed its IP address, checked for more conflicts,
accepted the new APIPA address, and updated the network.
Now as I've said before, it doesn't matter how the IP address assignment occurs,
whether it's a static assignment, whether it's a DHCP assignment,
or whether it's an APIPA assignment,
systems following this process will send out the three
requests for duplicate IP address detection,
if there is no conflict,
the assignment will succeed and the system will send out a gratuitous ARP to
synchronize the network to the new IP and MAC address snapping.
Let's take a look at that one more time, even if we go back to DHCP assignment.
To demonstrate this with DHCP, I'll start my capture again,
I'll set my network card to go back to DHCP,
click OK, click OK, and go back to my Wireshark.
Here again are the three packets used in the
duplicate IP address detection process.
The address assigned to my local network card from DHCP is going to be 20.
1.
4 and we can see from the packet details the same
duplicate IP address detection format, senders my network card,
sender IP address is set to zeros, target MAC address is set to zeros,
and the requested IP address from the LAN is 20.
1.
4, does this three times, and if no other system generates an IP conflict,
then my system accepts the DCHP offered IP address and sends out a
gratuitous ARP to the network to update all the ARP caches.
This unique use of ARP and robust methodology helps prevent duplicate IP addresses and communication interruption on the LAN.