ARP定義
ARP（Address Resolution Protocol,地址解析協議），是TCP／IP底層的協議，負責把IP地址轉爲對應的MAC地址（即網上48位的物理地址）。
之所以要ARP協議，因爲TCP／IP有兩個地址，網卡的48位物理地址和32位（IP4是32位，IP6是128位）的IP地址。而網卡的驅動程序工作在第一層，即鏈路層，只能識別48位的物理地址，不能識別工作在第二層網絡層的IP地址。如，網卡不在混雜模式下，只接收自己物理地址的以太網包和ffffffff的廣播地址以太網包。所以需要一個IP地址與物理地址的轉換映射。ARP協議就是把IP地址轉換成物理地址的映射的一種協議。
ARP實驗
本機的IP是192.168.6.2，網關192.168.6.254，子網掩網255.255.255.0，192.168.6.9是本網絡不存在的一個主機，192.168.6.1是本網絡存在的一個主機。
1、同一個網絡的不存在主機數據包訪問：
telnet 192.168.6.9 90
Trying 192.168.6.9...
telnet: Unable to connect to remote host: No route to host
10:50:52.487602 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:53.487601 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:54.487623 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:53.487601 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:54.487623 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
分析：對於同一網絡的訪問，本機如果在緩存的ARP不存在記錄，就會向網絡發廣播請求(一般網絡的廣播地址爲ff:ff:ff:ff:ff:ff)，如果發了三次都沒有主機迴應，就會判斷此網絡沒有此主機。
2、同一個網絡的存在主機數據包訪問：
telnet 192.168.6.1 90
11:03:13.766703 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.1 tell 192.168.6.2, length 28
11:03:13.780199 00:21:29:6c:eb:e2 > 00:24:2c:e6:06:95, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.6.1 is-at 00:21:29:6c:eb:e2, length 28
11:03:13.780223 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35044, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe512 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028049 ecr 0,nop,wscale 6], length 0
11:03:16.758611 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35045, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe224 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028799 ecr 0,nop,wscale 6], length 0
11:03:22.758628 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35046, offset 0, flags [DF], proto TCP (6), length 60)
11:03:13.780199 00:21:29:6c:eb:e2 > 00:24:2c:e6:06:95, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.6.1 is-at 00:21:29:6c:eb:e2, length 28
11:03:13.780223 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35044, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe512 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028049 ecr 0,nop,wscale 6], length 0
11:03:16.758611 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35045, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe224 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028799 ecr 0,nop,wscale 6], length 0
11:03:22.758628 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35046, offset 0, flags [DF], proto TCP (6), length 60)
2、不同一個網絡的主機數據包訪問：
telnet 192.168.7.1 90
11:21:21.857350 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1566, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x32a9 (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300073 ecr 0,nop,wscale 6], length 0
11:21:24.858616 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1567, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x2fba (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300824 ecr 0,nop,wscale 6], length 0
11:21:30.862609 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1568, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x29de (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2302324 ecr 0,nop,wscale 6], length 0
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x32a9 (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300073 ecr 0,nop,wscale 6], length 0
11:21:24.858616 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1567, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x2fba (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300824 ecr 0,nop,wscale 6], length 0
11:21:30.862609 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1568, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x29de (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2302324 ecr 0,nop,wscale 6], length 0
分析：對於不一網絡的訪問。主機不會向本地網絡發ARP請求，而是把請求封裝在IP包，發往本地的路由器。00:21:29:70:a5:8e是本地的路由器的物理地址。在本地看到沒有查詢192.168.7.1的ARP請求。本地的路由器會根據路由表把數據傳輸到對應的網絡。IP的數據包有TTL時間，每當過一個路由就會減1，如果目標不可達，或者TTL爲0時，就會向發起方返回ICMP的報文。
本文出自 51CTO.COM技術博客