ARP定义
ARP（Address Resolution Protocol,地址解析协议），是TCP／IP底层的协议，负责把IP地址转为对应的MAC地址（即网上48位的物理地址）。
之所以要ARP协议，因为TCP／IP有两个地址，网卡的48位物理地址和32位（IP4是32位，IP6是128位）的IP地址。而网卡的驱动程序工作在第一层，即链路层，只能识别48位的物理地址，不能识别工作在第二层网络层的IP地址。如，网卡不在混杂模式下，只接收自己物理地址的以太网包和ffffffff的广播地址以太网包。所以需要一个IP地址与物理地址的转换映射。ARP协议就是把IP地址转换成物理地址的映射的一种协议。
ARP实验
本机的IP是192.168.6.2，网关192.168.6.254，子网掩网255.255.255.0，192.168.6.9是本网络不存在的一个主机，192.168.6.1是本网络存在的一个主机。
1、同一个网络的不存在主机数据包访问：
telnet 192.168.6.9 90
Trying 192.168.6.9...
telnet: Unable to connect to remote host: No route to host
10:50:52.487602 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:53.487601 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:54.487623 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:53.487601 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
10:50:54.487623 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.9 tell 192.168.6.2, length 28
分析：对于同一网络的访问，本机如果在缓存的ARP不存在记录，就会向网络发广播请求(一般网络的广播地址为ff:ff:ff:ff:ff:ff)，如果发了三次都没有主机回应，就会判断此网络没有此主机。
2、同一个网络的存在主机数据包访问：
telnet 192.168.6.1 90
11:03:13.766703 00:24:2c:e6:06:95 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.6.1 tell 192.168.6.2, length 28
11:03:13.780199 00:21:29:6c:eb:e2 > 00:24:2c:e6:06:95, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.6.1 is-at 00:21:29:6c:eb:e2, length 28
11:03:13.780223 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35044, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe512 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028049 ecr 0,nop,wscale 6], length 0
11:03:16.758611 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35045, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe224 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028799 ecr 0,nop,wscale 6], length 0
11:03:22.758628 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35046, offset 0, flags [DF], proto TCP (6), length 60)
11:03:13.780199 00:21:29:6c:eb:e2 > 00:24:2c:e6:06:95, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.6.1 is-at 00:21:29:6c:eb:e2, length 28
11:03:13.780223 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35044, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe512 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028049 ecr 0,nop,wscale 6], length 0
11:03:16.758611 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35045, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.45654 > 192.168.6.1.90: Flags [S], cksum 0xe224 (correct), seq 2666822389, win 5840, options [mss 1460,sackOK,TS val 2028799 ecr 0,nop,wscale 6], length 0
11:03:22.758628 00:24:2c:e6:06:95 > 00:21:29:6c:eb:e2, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 35046, offset 0, flags [DF], proto TCP (6), length 60)
2、不同一个网络的主机数据包访问：
telnet 192.168.7.1 90
11:21:21.857350 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1566, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x32a9 (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300073 ecr 0,nop,wscale 6], length 0
11:21:24.858616 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1567, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x2fba (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300824 ecr 0,nop,wscale 6], length 0
11:21:30.862609 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1568, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x29de (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2302324 ecr 0,nop,wscale 6], length 0
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x32a9 (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300073 ecr 0,nop,wscale 6], length 0
11:21:24.858616 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1567, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x2fba (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2300824 ecr 0,nop,wscale 6], length 0
11:21:30.862609 00:24:2c:e6:06:95 > 00:21:29:70:a5:8e, ethertype IPv4 (0x0800), length 74: (tos 0x10, ttl 64, id 1568, offset 0, flags [DF], proto TCP (6), length 60)
192.168.6.2.41104 > 192.168.7.1.90: Flags [S], cksum 0x29de (correct), seq 2546343607, win 5840, options [mss 1460,sackOK,TS val 2302324 ecr 0,nop,wscale 6], length 0
分析：对于不一网络的访问。主机不会向本地网络发ARP请求，而是把请求封装在IP包，发往本地的路由器。00:21:29:70:a5:8e是本地的路由器的物理地址。在本地看到没有查询192.168.7.1的ARP请求。本地的路由器会根据路由表把数据传输到对应的网络。IP的数据包有TTL时间，每当过一个路由就会减1，如果目标不可达，或者TTL为0时，就会向发起方返回ICMP的报文。
本文出自 51CTO.COM技术博客
