ARP and RARP question - Tilted Forum Project Discussion Community

glytch · 01-30-2004, 08:14 PM

This is for the networking types (aren't all my questions?). The ARP command in Windows will resolve a MAC address from an IP address right? And there's also RARP, which is obviously the reverse (resolves an IP from a MAC address). Does anyone know the command for RARP, or is there even a command? It seems rather odd that there would be a command one way but not another.
My thoughts are, if you could get an IP once, you could use ARP to get the MAC and RARP to get the IP again at any time, right? This would be an interesting tool to use to find a dynamic IP address of a friend or something.
Sorry if the question is a stupid or simple one, and thanks in advance for anyone who tries to help.

oberon · 01-30-2004, 08:47 PM

ARP uses a cache. The cache expires fairly quickly. So unless you're in fairly constant communication with the IP in question (and, of course, it's on the same subnet), it's not always going to be there.

glytch · 01-30-2004, 08:54 PM

Ah, so you wouldn't be able to get a MAC address from an IP that isn't on your subnet this way?

madcow · 01-30-2004, 09:58 PM

Alright I know a little bit about this and there isn't really a way to do what you want.

Supposing there is a large network between you and your friend there will be multiple routers between you. In this case when your computer knows your friend's IP address (but not the MAC address) your computer sends out a ARP request with your friends IP address. Now the next router in the sequence between your and your friend will see this ARP request and your friends IP, and it knows the route to your friends IP address. So, the router will respond to your ARP request with its (the router's, not your friend's) MAC address. Your computer will catch this and log it. Now when you send to your friend with your friend's IP address and the router's MAC address, the router will know to pick up that packet (because of the MAC address) and forward it toward your friend (with his IP address).

Not sure if I explained that well or not but that is what is happening.

glytch · 01-30-2004, 10:08 PM

Hmm...I think I understand. That's too bad it's not possible. Thank you for the explaination, though!

Pragma · 01-31-2004, 08:30 AM

Inverse ARP is mostly used with Virtual Circuits for high-bandwidth lines, where the serial modems use IARP/RARP to send to the world "Hey, this is my MAC address - what's my IP?" - and they get a reply from the Telco or whatever hands out IP addresses. IARP isn't really something you'll see used in a consumer situation, because - well - it's very limited in terms of what you can do with it.

Because you can't exactly multicast/broadcast to the global internet, you're pretty much limited to your subnet. So on the off chance you can send the packet to your subnet saying "Who has the IP for MAC address AA:BB:CC

D:EE:FF?" - I'm not even sure that Windows/MacOS/Linux/BSD (by default, or at all) are capable of responding.

Caveat lector: I just woke up from being very drunk, my information may not be entirely accurate.

01-30-2004, 08:14 PM	#1 (permalink)
glytch I am not permanent. Location: Tennessee	ARP and RARP question This is for the networking types (aren't all my questions?). The ARP command in Windows will resolve a MAC address from an IP address right? And there's also RARP, which is obviously the reverse (resolves an IP from a MAC address). Does anyone know the command for RARP, or is there even a command? It seems rather odd that there would be a command one way but not another. My thoughts are, if you could get an IP once, you could use ARP to get the MAC and RARP to get the IP again at any time, right? This would be an interesting tool to use to find a dynamic IP address of a friend or something. Sorry if the question is a stupid or simple one, and thanks in advance for anyone who tries to help. __________________ If you're flammable and have legs, you are never blocking a fire exit. - Mitch Hedberg

01-30-2004, 08:47 PM	#2 (permalink)
oberon Quadrature Amplitude Modulator Location: Denver	ARP uses a cache. The cache expires fairly quickly. So unless you're in fairly constant communication with the IP in question (and, of course, it's on the same subnet), it's not always going to be there. __________________ "There are finer fish in the sea than have ever been caught." -- Irish proverb

01-30-2004, 08:54 PM	#3 (permalink)
glytch I am not permanent. Location: Tennessee	Ah, so you wouldn't be able to get a MAC address from an IP that isn't on your subnet this way? __________________ If you're flammable and have legs, you are never blocking a fire exit. - Mitch Hedberg

01-30-2004, 09:58 PM	#4 (permalink)
madcow Crazy Location: The state of denial	Alright I know a little bit about this and there isn't really a way to do what you want. Supposing there is a large network between you and your friend there will be multiple routers between you. In this case when your computer knows your friend's IP address (but not the MAC address) your computer sends out a ARP request with your friends IP address. Now the next router in the sequence between your and your friend will see this ARP request and your friends IP, and it knows the route to your friends IP address. So, the router will respond to your ARP request with its (the router's, not your friend's) MAC address. Your computer will catch this and log it. Now when you send to your friend with your friend's IP address and the router's MAC address, the router will know to pick up that packet (because of the MAC address) and forward it toward your friend (with his IP address). Not sure if I explained that well or not but that is what is happening. __________________ Smoke me a kipper, I'll be back for breakfast. Last edited by madcow; 01-30-2004 at 10:06 PM..

01-30-2004, 10:08 PM	#5 (permalink)
glytch I am not permanent. Location: Tennessee	Hmm...I think I understand. That's too bad it's not possible. Thank you for the explaination, though! __________________ If you're flammable and have legs, you are never blocking a fire exit. - Mitch Hedberg

01-31-2004, 08:30 AM	#6 (permalink)
Pragma I am Winter Born Location: Alexandria, VA	Inverse ARP is mostly used with Virtual Circuits for high-bandwidth lines, where the serial modems use IARP/RARP to send to the world "Hey, this is my MAC address - what's my IP?" - and they get a reply from the Telco or whatever hands out IP addresses. IARP isn't really something you'll see used in a consumer situation, because - well - it's very limited in terms of what you can do with it. Because you can't exactly multicast/broadcast to the global internet, you're pretty much limited to your subnet. So on the off chance you can send the packet to your subnet saying "Who has the IP for MAC address AA:BB:CCD:EE:FF?" - I'm not even sure that Windows/MacOS/Linux/BSD (by default, or at all) are capable of responding. Caveat lector: I just woke up from being very drunk, my information may not be entirely accurate. __________________ Eat antimatter, Posleen-boy!