Monday, August 25, 2014

ARP Protocol and Detection of Change in Gateway (router/BHR) through ARP

ARP (Address resolution protocol) is used by the Internet protocol (IP) to map IP address to MAC address. In other words, ARP is used for the resolution of network layer addresses to the link layer addresses and hence it falls as a layer 2 protocol of the OSI model.

Suppose a device (PC/laptop/set top/Mobile) connected via a gateway (router/BHR - Broadband home router) needs to communicate to the outside world over ethernet it needs to determine the MAC address of the gateway (henceforth gateway, router and BHR are used interchangeably) given it's IP address. These IP-to-MAC address mappings are derived from the the ARP cache maintained on every device. 

An ARP cache or an ARP table is a record that contains IP-MAC address mappings of the gateways in the subnet to which a given device is connected. If the IP address does not appear in the device's cache, that device cannot target messages to the target until IP-MAC is obtained. In this case, the device broadcasts an ARP request asking what is the MAC address of the gateway. The gateway receives this ARP request and sends an ARP response to the device that contains it's MAC address. This information is updated in the ARP cache of the device. Then on, whenever the device wishes to communicate over ethernet the MAC address of the gateway is obtained from the ARP cache unless the ARP cache is expired. 
This is all about the ARP protocol, arp cache, arp request and arp responses. Now let's see about detecting a gateway change in the network. 

You may be thinking why gateway change has to be detected and what happens if the gateway change goes undetected ?
Generally all the devices connected to the router obtains a DHCP IP address. Here the device not really owns a DHCP IP address but it leases for a certain period of time after the expiration of which the DHCP IP lease has to be renewed. 
Consider an use case scenario in which a client device has leased a DHCP IP from the gateway/router (let the router be R1 having the ip IP1). Let the router R1 be replaced with the router R2 having the same IP address IP1. In such a scenario if the gateway change is not detected the client device would not renew it's lease until the lease expires. The arp cache would still be containing the MAC address of router R1 and all communications from the client devices fail as the arp cache is not updated with the new router's MAC address.

Let's see how do we detect a change in the gateway and thereby renew DHCP IP address ?
When the client device wishes to communicate with the other device or to the public internet, it broadcasts ARP request asking the MAC address of the gateway. The gateway responds with a message (ARP response) which includes it's MAC address. If the gateway is replaced with a different gateway, the ARP response would contain a different MAC address and the change in the gateway could be detected. Once the gateway change is detected, all the client devices de-configures and binds to DHCP IP interface again to obtain a new DHCP IP that helps in maintaining the connectivity which otherwise results in a outage.

Thus the detection of a change in the gateway and thereby renewing DHCP IP address puts the device active in the network and keeps the device connected.