Ethernet encapsulation: ARP

There was a brief discussion earlier about what IP datagrams look like on an Ethernet.
The discussion showed the Ethernet header and checksum. However it left one hole: It
didn't say how to figure out
what Ethernet address to use when you want to talk to a given Internet address. In fact,
there is a separate protocol for this, called ARP ("address resolution protocol"). (Note by
the way that ARP is not an IP protocol. That is, the ARP datagrams do not have IP
headers.)
Suppose you are on system 128.6.4.194 and you want to connect to system 128.6.4.7.
Your system will first verify that 128.6.4.7 is on the same network, so it can talk directly
via Ethernet. Then it will look up 128.6.4.7 in its ARP table, to see if it already knows the
Ethernet address. If so, it will stick on an Ethernet header, and send the packet. But
suppose this system is not in the ARP table. There is
no way to send the packet, because you need the Ethernet address. So it uses the ARP
protocol to send an ARP request. Essentially an ARP request says "I need the Ethernet
address for 128.6.4.7". Every system listens to ARP requests. When a system sees an
ARP request for itself, it is required to respond. So 128.6.4.7 will see the request, and will
respond with an ARP reply saying in effect "128.6.4.7 is
8:0:20:1:56:34". (Recall that Ethernet addresses are 48 bits. This is 6 octets. Ethernet
addresses are conventionally shown in hex, using the punctuation shown.) Your system
will save this information in its
ARP table, so future packets will go directly. Most systems treat the ARP table as a
cache, and clear entries in it if they have not been used in a certain period of time.
Note by the way that ARP requests must be sent as "broadcasts". There is no way that an
ARP request can be sent directly to the right system. After all, the whole reason for
sending an ARP request is that
you don't know the Ethernet address. So an Ethernet address of all ones is used, i.e.
ff:ff:ff:ff:ff:ff. By convention, every machine on the Ethernet is required to pay attention
to packets with this as an
address. So every system sees every ARP requests. They all look to see whether the
request is for their own address. If so, they respond. If not, they could just ignore it.
(Some hosts will use ARP requests to
update their knowledge about other hosts on the network, even if the request isn't for
them.) Note that packets whose IP address indicates broadcast (e.g. 255.255.255.255 or
128.6.4.255) are also sent with an Ethernet address that is all ones.