What OSI layer are ARP and RARP?

[silverspecv]

There is some debate amongst my group on these 2 separate topics. For some reason ARP and RARP are always grouped together, but this is 2 questions: What OSI layer are ARP and RARP?

As far as I can tell, they are both layer 2 protocols, although they obviously compliment or supplement higher layers.

RARP is either a predecessor of DHCP or it at least has a similar function. You send out a layer 2 frame to the broadcast address FF:FF:FF:FF:FF:FF and ask for an IP address, and then hopefully and RARP server receives the frame and gives you one. Since the whole point is to GET an IP address, this would completely exclude above layer 2, so it would HAVE to be a layer 2 protocol right?

ARP is for communicating on the local ethernet broadcast segment. If you have a layer 3 packet from one ip address to another ip address, that alone does not enable communication, because the layer 3 packet must be encapsulated in a later 2 frame which requires the destination MAC address in the ethernet header. So before you send the packet, you send out an ARP request to broadcast address FF:FF:FF:FF:FF:FF with the data portion containing an ARP request instead of an encapsulated IP packet. The data contains the requested IP address. All hosts on the segment "hear" the request since it is sent to the mac broadcast address, and the host that has the requested IP address sends a layer 2 ARP reply directly to the requesting host's mac address (which was contained in the sender portion of the original ARP request) and containing its own MAC address. Upon receipt of the MAC address of the cooresponding IP address, the sending host encapsulates the original layer 3 packet in a layer 2 frame and sends the frame to the ethernet.

I can see how there might be some debate over ARP, but RARP is pretty clear-cut right? These guys are saying they have found material on CISCO's web site and in various books stating that ARP/RARP are layer 3 protocols. I am completely open to expert testimony, but I have done research myself, and I have found nothing to the contrary except one web site which claims they are layer 4 protocols, but I will not believe that unless someone else confirms it.

web links much appreciated, btw.. I could use some ammo

 

[silverspecv]

Actually, I am now finding materials that do list ARP and RARP in layer 3, so now I'm really confused. Please someone help me out.

 

[silverspecv]

(yes I'm going to talk to myself until I figure this out)

I suppose from another point, layer 2 doesn't actually communicate any data or possess any intelligence, it only enables communication for higher level protocols. So from that angle, maybe ARP and RARP operate at layer 3 and suppliment layer 2 rather than the other way around?

 

[silverspecv]

To support the layer 3 answer, here is a tcp dump from a linux machine that shows host 192.168.99.35 trying to ping 192.168.0.254.

tcpdump: listening on eth0
0:80:c8:f8:4a:51 ff:ff:ff:ff:ff:ff 42: arp who-has 192.168.99.254 tell 192.168.99.35
0:80:c8:f8:5c:73 0:80:c8:f8:4a:51 60: arp reply 192.168.99.254 is-at 0:80:c8:f8:5c:73
0:80:c8:f8:4a:51 0:80:c8:f8:5c:73 98: 192.168.99.35 > 192.168.99.254: icmp: echo request (DF)
0:80:c8:f8:5c:73 0:80:c8:f8:4a:51 98: 192.168.99.254 > 192.168.99.35: icmp: echo reply

You can see in line 1 and 2 that there is an arp request encapsulated within a broadcast frame, IE ARP would be a layer 3 protocol that is on par with IP.

But then I find incredibly specific information like this:

http://www.geocities.com/SiliconValley/Vista/8672/network/arp.html

and

http://www.geocities.com/SiliconValley/Vista/8672/network/rarp.html

Which specifically state that they are layer 2 protocols:

To which OSI layer does ARP belong?
ARP belongs to the OSI data link layer (Layer 2). ARP protocol is implemented by the network protocol driver. ARP packets are encapsulated by Ethernet headers and transmitted.

To which OSI layer does RARP belong?
RARP belongs to the OSI data link layer (layer 2).

I mean WTF guys??? My friends and I are in a mad searching battle royale with this. Is it that debatable that there is no real answer??

 

[bierhunter]

Your question actually made me start questioning myself, so I took the challenge to try and find out.

http://compnetworking.about.com/library/gallery/blbasics_osimodel3.htm

About.com states that ARP is layer-2.

http://www.delmar.edu/Courses/ITNW1325/sem1/notes/lessons16-19.html

delmar.edu Cisco curriculum states ARP is layer-3.

http://www.webopedia.com/TERM/A/ARP.html

Webopedia.com Says Network Layer (layer-3)

http://www.cisco.com/warp/public/535/4.html

Cisco.com Has a diagram showing ARP,RARP in the upper half of layer-2. This one makes more sense due to ARP being used for multiple protocols including IPX, ATM which are layer-2 protocols.

It looks like there is a lot of confusion out there about this.

Personally, I'm going with Layer-2.





BierHunter
CNE, MCSE, CCNP

 

[bierhunter]

I wish we could edit our posts.

Here's another one

http://www.lex-con.com/protocols/ip.htm

Although ARP is considered part of the Internet Protocol suite, it operates at layer-2.

Also just found this one.

http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/arp.html

I also discovered some CCNP practice exams online claiming layer-3 for ARP. People will need to be careful on this one. I'll dig through my old Cisco books and see if any of the study material I used has some info.

BierHunter
CNE, MCSE, CCNP

 

[bierhunter]

Wow...lots of confusing info on the web about ARP.

Here's my final conclusion.

ARP is a part of the IP suite which is why it is often referred to as a layer-3 protocol. However, it actually operates at the Logical Link Control layer which is part of layer-2.

If someone is studying for a test, I would recommend answering the question according what the book/instructor wants as an answer.

Similar to subnetting and dropping the first and last subnets. For testing purposes, that is true. In the real world, the first and last subnets work just fine.


According to me, it's layer-2.


BierHunter
CNE, MCSE, CCNP

 

[silverspecv]

I'm having very similar mixed results.

On one hand, layer 2 communication is nothing more than converting data to/from 1's and 0's and watching the crc's. It doesn't actually communicate, per se. This would imply that they are layer 3, since they are actually *doing* something.

On the other hand, a lot of the documentation states that arp, at least, is implemented in the device driver, which is clearly a low level function, meaning layer 2.

But then I suppose this is an entirely theoretical discussion anyway, and the OSI model is a guideline, not an actually implementation, so there may be room for interpretation.

The horrible part is that this was spawned by a discussion about a potential mistake an instructor made in a CISSP (security) class, and has next to nothing to do with that certification. But I am also studying CCNA, which is why I would like to full understand this.