ARP

It starts with the initiator sending an ARP Request as a broadcast frame to the entire network. 

The Ethernet header will include three fields: a Destination MAC address, a Source MAC address, and an EtherType.

The ARP payload itself has a few fields which are worth discussing.

Notice the Target IP address is filled in (10.0.0.22), but the Target MAC address is all zeros. Since Host A does not know Host B’s MAC address.

The ARP Response payload contains the same fields as the request above.

When the ARP process completes, the information learned is stored in an ARP Table, or ARP Cache.

Typically, for clients and end hosts, the ARP timeout will be pretty short – typically 60 seconds or less.






Whereas for network infrastructure devices (routers, firewalls, etc), the ARP timeout is very long – typically 2-4 hours
====================================