Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium



Posted on 2004-10-26
Medium Priority
Last Modified: 2013-11-29
Please can anyone describe for me what is a ARP, RARP and where and in which way they are useful.

Please don`t mention the definition used in Webopedia. I studied them but didn`t got the exact point. Please describe them in detial.

thanks in advance.
Question by:dineshb_2001
LVL 97

Expert Comment

by:Lee W, MVP
ID: 12408262
A MAC address is something like an electronic serial number.  Whenever info is sent from your computer, the packet contains the MAC Address.  ARP (Address Resolution Protocol) resolves the MAC address to an IP Address.  In a sense this identifies the calling computer connecting to your computer.  Think of it in terms of a car - the MAC is like a Vehicle Identification Number (VIN) and the license plate like an IP Address.  You can easy change the license plate and pass it to someone else, in theory, you can't do that easily with the VIN/MAC address.

RARP is simply the reverse of ARP.  It effectively finds the MAC address of the device with an IP Address.

It's important to note that network switches and routers can mask the correct MAC address of something as they can effectively replace it with their own as the packet travels through them

Expert Comment

ID: 12408336
from the CCNA-

The Address Resolution Protocol (ARP) is an Internet layer protocol that helps TCP/IP devices find other devices in the same broadcast domain. ARP uses a local broadcast to discover neighboring devices. Basically, ARP resolves an IP address of a destination to theMACaddress of the destination on the same data link layer medium. Remember that for two devices to talk to each other in Ethernet, the data link layer uses MAC addresses to differentiate the machines on the segment. And that when devices talk to each other at the data link layer, they need to know the destination’s MAC address.

RARP is sort of the reverse of an ARP. In an ARP, the device knows the layer-3 address, but not the data-link layer address. With a RARP, the device doesn’t have an IP address and wants to acquire one. The only address that this device has is a MAC address. Common protocols that use RARP are BOOTP and the Dynamic Host Configuration Protocol (DHCP).


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.


Accepted Solution

kidoman earned 500 total points
ID: 12410094

Well I will take it from you (and anyways I wasn't going to quote the definition.)

ARP (Address Resolution Protocol) and R (Reverse) ARP are two different protocols performing two complementory operations. I hv given some live examples of ARP and RARP in operation (tho the example used to exaplain a form of ARP (Proxy ARP) will never occur in real life, but it gets the point accros.)

note tho: NIC = Network Interface Card = LAN card


Taking that you are aware of the OSI model of internetworking, you might be knowing that the "Networking Layer" communicates using IP addresses. Suppose my computer (with IP address wanted to send a packet to then this would be the brief process:

(1) - Since my IP address lies in the same subnet as (more on this later) assume that the target IP address is physically connected to me. (or rather my NIC hving IP addr

The same subnet decision is made very easily. As you might be aware of, a IP address consists of a Network ID part and a Host ID part. If the Network IDs of two IP addresses are same, then they are considered to be physically reachable (connected to the same ethernet segment.)

So the CIDR (Classless Inter-Domain Routing) /24 specifies that has a host ID of which is the same as that of

(2) - The packet is handed down to the Datalink layer without any modification.

(3) - The datalink layer need to deliver the packet to the corresponding datalink layer on the destination machine. To do this, it will hv to hand appropiate information to the physical layer of the TCP/IP or OSI model. This appropiate machine consists of "the physical address of the target NIC" rather than the IP address. There fore, there must exist a way of mapping the IP address => to the physical address.

The physical address in this case is the MAC (Medium Access Control) address which is unique for each manufactured NIC (Lan Card) in the world. Basically it is nothing but like the plot numbers assigned to each house which the mailman uses to deliver the snail mail. Very similar.

                         IP addr                                MAC addr
(Upper layers) =======> (Data link layer) =========> (Physical layer), Source NIC
(Upper layers) <======= (Data link layer) <========= (Physical layer), Dest NIC

The three bars represent the actual connection, whether it be a cross over cable, connection via hub, switch or any other interface (like FDDI ring.)

So this mapping of IP address to MAC address within a subnet "i.e. NICs hving same host id" is done using ARP.

A typical ARP exchange is like so (taking our example above): > (broadcast addr): arp who-has tell > arp reply is-at 0:c:29:6c:d7:63

one subtle point is that ARP REQUESTS are broadcast (delivered to all NICs within a subnet (physically connected)) but ARP REPLIES are Point-to-Point.

now the node is aware of the MAC address associated with and thus passes the packets and the dest. MAC address to the :Physical layer: which delivers the packet.

Proxy ARP: Suppose a bridge separated two different subnets. One and other ARP will be adequate for packet delivery within the respective subnets. But if a host , say H1(, wants to send soming to host H2 ( then what to do:

1 - we could specify the IP address of the bridge/router as the default gateway for the subnet so that if it wanted to communicate with some machine outside the subnet it would send the packets to the gateway which would do the routing.

otherwise, 2 - trick the first subnet and make the bridge "reply" its mac address as the IP -- > MAC mapping during ARP process. > arp who-has tell (the router) > arp reply is-at (MAC ADDR)

so the H1 will send its packet to the router and it will be handled appropiately. This is the use of proxy arp.


R-ARP was used earlier (now it has been replaced by technologies like BOOTP or DHCPD) to support diskless-workstation (a.k.a. thin clients)

Suppose a machine was booted of a ROM medium with no facility of any configuration file to set a IP address, how would it obtain the parameters (in this case the IP Address.)

to solve this problem, RARP was invented so that a thin client would broadcast its MAC address (which is embedded into the NIC (lan card) and dosent require any configuration expect putting in a required hardware) and a designated server would reply Point-to-Point to the MAC address that it should take its IP address to be whatever the sysadmin desided while performing the mapping.

Better technologies hv replaced the need for RARP and its use has declined.

Hope this gives a indepth view of the functioning of ARP and its less used sibling RARP.


Expert Comment

ID: 12410114
Hi again,

I was going through posts before mine, and I would like to contradict by saying that BOOTP and DHCP replaced the aging RARP protocol and dont use it in any way.



Expert Comment

ID: 12410247
ARP is a layer 3 protocol  resolves MAC Address (Hexadecimal or NIC card address or Physical address) to IPaddress or logical address.Arp mailtains a table of Mac vs Ip address called as ARP cache...............

at command prompt type arp -a   u can see what all hapens.....
RARP does the reverse of this...........

if u go in depth, allthough ARP is a layer 3 protocol it does not use an IP header, it has its own packet format and is a broadcast on the local LAN within the data field of a layer 2 frame without needing to be routed. The Ethernet Type field has the value 0x0806 to indicate an ARP.

Expert Comment

ID: 12410353
Hi thribhu,

Sorry, but I think you are wrong about ARP resolving "MAC Address (Hexadecimal or NIC card address or Physical address) to IPaddress or logical address"

ARP does exactly the opposite: maps IP addresses to MAC addresses because the physical addresses are what the physical layer understands and thus mandates to be able to succesfully send the frames.

RARP obviously does the reverse but does not see the same frequency of use (if at all) as ARP does.


Expert Comment

ID: 12414205
Thanks a lot.

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
Make the most of your online learning experience.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question