Wiznet makers

Hardwired TCP/IP Chapter 17: W55MH32 ARP Example

In this article, we will provide a detailed explanation on how to implement the MAC RAW mode on the W55MH32 chip. Through practical examples, we will also explain to you how to use the MAC RAW mode to perform ARP to convert IP addresses into MAC addresses.

Other network protocols used in this example, such as DHCP, please refer to the relevant sections. Regarding the initialization process of the W55MH32, please refer to the Network Install section. We will not elaborate on this here.

1 Introduction to the MACRAW Model

The MACRAW mode is a low-level communication mode provided by W55MH32 TOE. The chip directly receives and sends Ethernet frames without parsing the protocols of the TCP/IP layer. Through this mode, users can directly manipulate the headers of Ethernet frames (such as destination MAC address, source MAC address, Ethernet type, etc.) and the payload data.

Note: Only Socket0 can be set to the MACRAW mode.

2 Introduction to the ARP Protocol

ARP (Address Resolution Protocol) is a network protocol used to resolve the corresponding MAC address based on the known IP address. It operates at the second layer (data link layer) of the OSI model and is an important component of local area network communication in IPv4 networks.

3 Characteristics of the ARP Protocol

Protocol scope: The ARP protocol operates only within the same local area network (LAN) because broadcast requests cannot pass through routers.

Cache mechanism: To reduce frequent broadcasts, devices will cache the corresponding relationship between IP and MAC for a certain period of time.

Protocol types: ARP request (Opcode = 1): Used to query the MAC address of the target device.

ARP response (Opcode = 2): Used to reply to the ARP message from the requesting party.

4 The workflow of the ARP protocol request

When the sending host A needs to communicate with the target host B, but only knows the IP address of the target host and does not know the MAC address of the target host, and there is no corresponding relationship in its own ARP cache table, the ARP request process will be triggered:

1. Construct ARP request: The sending host needs to construct an ARP request data packet.

2. Broadcast ARP request: The sending host encapsulates the constructed ARP request into an Ethernet frame and sends it to the local area network using the broadcast method.

3. Target host receives and processes: All hosts in the network will receive the broadcast frame, but only the target host (with the matching IP address) will respond.

4. Sending host receives the ARP response and updates its own ARP cache table.

5 Application scenarios of the ARP protocol

• Address Resolution: When a device needs to conduct link layer communication, it can use the ARP protocol to obtain the MAC address of the other device.
• Network debugging and diagnosis: When debugging an embedded device, sending an ARP request can be used to verify the network connectivity of the device.

6 Security Risks of the ARP Protocol and Protective Measures

Although the ARP protocol is extremely important in local area network communication, it also has security risks. For instance, ARP spoofing is a common attack method. Attackers can deceive other devices by forging ARP responses, thereby stealing sensitive information or interrupting network communication. To prevent ARP spoofing attacks, the following measures can be taken:

1. Using Static ARP Table: By configuring static ARP entries, it is possible to limit and specify that devices communicating with the IP address only use the designated MAC address. Thus, even if attackers send forged ARP messages, they cannot modify the mapping relationship between the IP address and MAC address in this table.

2. Port Security and Static IP/MAC Binding: Enable the Port Security function on the access switch and statically bind the user's IP/MAC address. This method can prevent users from sending fake ARP information for the gateway.

3. Dynamic ARP Inspection (DAI) and DHCP Monitoring: Use the combination of Dynamic ARP Inspection and DHCP Monitoring functions to perform legality detection on the ARP messages sent by users and filter out those that do not comply with the rules.

4. Encrypted Communication Protocol: By using encrypted communication protocols, network traffic can be prevented from being eavesdropped and tampered with.

5. Firewall and Switch Configuration: Set corresponding security policies on the firewall and switch, such as enabling special ARP message filtering functions.

6. Client Management: Ensure that all terminal devices follow the security policies and update and patch them regularly.

7 The working principle of the ARP protocol

Send ARP request:

When device A needs to communicate with device B, it first checks if the MAC address of device B is present in the ARP cache. If the MAC address of device B is not found in the ARP cache, device A will send a broadcast ARP request message in the following format: "Who is the IP address X.X.X.X? Please tell me (device A's IP address and MAC address)."

Receive ARP response:

After receiving the broadcast request, device B checks whether the IP address in the request matches its own. If it does, device B sends a unicast ARP response message to device A, informing device B of its MAC address. After receiving the response, device A caches the MAC address of device B for subsequent communication.

8 ARP message format

A standard ARP message consists of the following fields, with a total length of 28 bytes (excluding the link layer frame header):

Detailed Explanation of Message Fields

1. Hardware Type (Hardware Type): Describes the type of network being used, for example:

• 1: Ethernet.
• 6: IEEE 802 network.

For Ethernet ARP packets, this value is always 0x0001.

2. Protocol Type (Protocol Type): Indicates the type of protocol to be parsed, for example:

• 0x0800: Indicates IPv4 address resolution.
• 0x86DD: Indicates IPv6 (usually replaced by the ND protocol instead of ARP).

3. Hardware Address Length (Hardware Address Length): Defines the length of the hardware address (MAC address), usually 6 bytes (Ethernet).

4. Protocol Address Length (Protocol Address Length): Defines the length of the protocol address (IP address), usually 4 bytes (IPv4).

5. Operation Code (Operation Code): Describes the operation type of ARP:

• 1: ARP request.
• 2: ARP response.

6. Sender Hardware Address (Sender Hardware Address): Contains the MAC address of the requesting device.

7. Sender Protocol Address (Sender Protocol Address): Contains the IP address of the requesting device.

8. Target Hardware Address (Target Hardware Address): In ARP requests, this field is empty (all 0s). In ARP responses, it contains the MAC address of the target device.

9. Target Protocol Address (Target Protocol Address): Contains the IP address of the target device.

Message content:

ARP Probe Request Packet:

|Message Analysis|
Address Resolution Protocol (ARP Probe) (ARP Probe request message, used to detect if the target IP address is conflicting)
Hardware type: Ethernet (1) (Hardware type: 1 indicates Ethernet)
Protocol type: IPv4 (0x0800) (Protocol type: 0x0800 indicates IPv4)
Hardware size: 6 (Hardware address length: 6 bytes)
Protocol size: 4 (Protocol address length: 4 bytes)
Opcode: request (1) (Operation code: 1 indicates ARP request)
[Is probe: True] (Is it a probe: Yes, used for detecting IP conflicts)
Sender MAC address: Wiznet_12:22:12 (00:08:dc:12:22:12) (Sender MAC address: 00:08:dc:12:22:12)
Sender IP address: 0.0.0.0 (Sender IP address: Unassigned, used for probing)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00) (Target MAC address: All 0s, not specified)
Target IP address: 192.168.1.105 (Target IP address: 192.168.1.105, probing object) 

|Original Message| 00 01 08 00 06 04 00 01 00 08 dc 12 22 12 00 00 00 00 00 00 00 00 00 00 c0 a8 01 69

ARP Request Message:

|Message Analysis|
Address Resolution Protocol (request) (Request Message)
Hardware type: Ethernet (1) (Hardware Type: 1 indicates Ethernet)
Protocol type: IPv4 (0x0800) (Protocol Type: 0x0800 indicates IPv4)
Hardware size: 6 (Hardware Address Length: 6 bytes)
Protocol size: 4 (Protocol Address Length: 4 bytes)
Opcode: request (1) (Operation Code: 1 indicates ARP request)
Sender MAC address: Wiznet_12:22:12 (00:08:dc:12:22:12) (Sender MAC Address)
Sender IP address: 192.168.1.105 (Sender IP Address: 192.168.1.105)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00) (Unknown physical address of the target device)
Target IP address: 192.168.1.138 (Target IP Address: 192.168.1.138, IPv4 address of the target device) 

|Original Message| 00 01 08 00 06 04 00 01 00 08 dc 12 22 12 c0 a8 01 69 00 00 00 00 00 00 c0 a8 01 8a

ARP response message:

|Message Analysis|
Address Resolution Protocol (reply) (Response Message)
Hardware type: Ethernet (1) (Hardware Type: 1 indicates Ethernet)
Protocol type: IPv4 (0x0800) (Protocol Type: 0x0800 indicates IPv4)
Hardware size: 6 (Hardware Address Length: 6 bytes)
Protocol size: 4 (Protocol Address Length: 4 bytes)
Opcode: reply (2) (Operation Code: 2 indicates ARP response)
Sender MAC address: HP_b1:37:11 (64:4e:d7:b1:37:11) (Sender MAC Address: 64:4e:d7:b1:37:11)
Sender IP address: 192.168.1.138 (Sender IP Address: 192.168.1.138)
Target MAC address: Wiznet_12:22:12 (00:08:dc:12:22:12) (Target MAC Address, Physical Address of the ARP requester)
Target IP address: 192.168.1.105 (Target IP Address: 192.168.1.105, IPv4 Address of the ARP requester) 

|Original Message| 00 01 08 00 06 04 00 02 64 4e d7 b1 37 11 c0 a8 01 8a 00 08 dc 12 22 12 c0 a8 01 69

9 The implementation process

Next, let's take a look at how to implement an ARP request on the W55MH32.

Note: The test instance requires that the PC and the W55MH32 be in the same network segment.

Step 1: Call the do_arp() function within the main loop to execute the ARP request process.

1.     while (1)
2.     {
3.        do_arp(SOCKET_ID, ethernet_buf, dest_ip);;
4.     }

The do_arp() function is as follows:

 1. void do_arp(uint8_t sn, uint8_t *buf, uint8_t *dest_ip)
 2. {
 3.     uint16_t rlen       = 0;
 4.     uint16_t local_port = 5000;
 5.     uint16_t cnt        = 0;
 6.  
 7.     switch (getSn_SR(sn))
 8.     {
 9.     case SOCK_CLOSED:
10.         close(sn);
11.         socket(sn, Sn_MR_MACRAW, local_port, 0x00);
12.         break;
13.     case SOCK_MACRAW:
14.         arp_request(sn, local_port, dest_ip);
15.  
16.         while (1)
17.         {
18.             if ((rlen = getSn_RX_RSR(sn)) > 0)
19.             {
20.                 arp_reply(sn, buf, rlen);
21.                 break;
22.             }
23.             if (cnt > 1000)
24.             {
25.                 printf("Request Time out.\r\n");
26.                 cnt = 0;
27.                 break;
28.             }
29.             else
30.             {
31.                 cnt++;
32.                 delay_ms(5);
33.             }
34.         }
35.         break;
36.     }
37.     if (arp_succ_flag)
38.         while (1);
39. }

After entering this function, the program will execute a state machine. When the socket status is in the closed state, a MACRAW mode socket will be opened. Once the socket is successfully opened in the MAC RAW mode, the arp_request() function will be executed to send an ARP request, and then a loop will be entered. When a response is successfully received, the arp_reply() function will be executed to parse the request. If no response is received within 5 seconds, the ARP request fails. When the arp_succ_flag flag is set to 1, it indicates that the ARP request was successful.

The arp_request() function is as follows:

 1. void arp_request(uint8_t sn, uint16_t port, uint8_t *dest_ip)
 2. {
 3.     uint16_t i;
 4.     uint8_t  broadcast_addr[4] = {0xff, 0xff, 0xff, 0xff};
 5.  
 6.     for (i = 0; i < 6; i++)
 7.     {
 8.         pARPMSG.dst_mac[i] = 0xff; // Broadcast address in an Ethernet frame
 9.         pARPMSG.tgt_mac[i] = 0x00;
10.         if (i < 4)
11.         {
12.             pARPMSG.tgt_ip[i] = dest_ip[i];
13.         }
14.     }
15.     getSHAR(pARPMSG.src_mac);              // Fill in the source MAC address of the link layer
16.     getSHAR(pARPMSG.sender_mac);           // Fill in the MAC address of the sender in ARP
17.     getSIPR(pARPMSG.sender_ip);            // Enter the IP address of the sender in ARP
18.     pARPMSG.msg_type = htons(ARP_TYPE);    // ARP type
19.     pARPMSG.hw_type  = htons(ETHER_TYPE);  // Ethernet type
20.     pARPMSG.pro_type = htons(PRO_TYPE);    // IP
21.     pARPMSG.hw_size  = HW_SIZE;            // 6
22.     pARPMSG.pro_size = PRO_SIZE;           // 4
23.     pARPMSG.opcode   = htons(ARP_REQUEST); // request: 0x0001;  reply: 0x0002
24.  
25.     if (sendto(sn, (uint8_t *)&pARPMSG, sizeof(pARPMSG), broadcast_addr, port) != sizeof(pARPMSG))
26.     {
27.         printf("Fail to send arp request packet.\r\n");
28.     }
29.     else
30.     {
31.         if (pARPMSG.opcode == htons(ARP_REQUEST))
32.         {
33.             printf("Who has %d.%d.%d.%d ?  Tell %d.%d.%d.%d\r\n", pARPMSG.tgt_ip[0], pARPMSG.tgt_ip[1], pARPMSG.tgt_ip[2], pARPMSG.tgt_ip[3],
34.                    pARPMSG.sender_ip[0], pARPMSG.sender_ip[1], pARPMSG.sender_ip[2], pARPMSG.sender_ip[3]);
35.         }
36.         else
37.         {
38.             printf("Opcode has wrong value. check opcode!\r\n");
39.         }
40.     }
41. }

In this function, the ARP packets are assembled and sent.

The arp_reply() function is as follows:

 1. void arp_reply(uint8_t sn, uint8_t *buff, uint16_t rlen)
 2. {
 3.     uint8_t  destip[4];
 4.     uint16_t destport;
 5.     uint8_t  ret_arp_reply[128];
 6.     uint8_t  i;
 7.  
 8.     recvfrom(sn, (uint8_t *)buff, rlen, destip, &destport);
 9.  
10.     if (buff[12] == ARP_TYPE_HI && buff[13] == ARP_TYPE_LO)
11.     {
12.         aAPRMSG = (ARPMSG *)buff;
13.         if ((aAPRMSG->opcode) == htons(ARP_REPLY))
14.         {
15.             for (i = 0; i < 4; i++)
16.             {
17.                 if (aAPRMSG->tgt_ip[i] != pARPMSG.tgt_ip[i])
18.                 {
19.                     break;
20.                 }
21.                 arp_succ_flag = 1;
22.             }
23.             memset(ret_arp_reply, 0x00, 128);
24.             sprintf((char *)ret_arp_reply, "%d.%d.%d.%d is at %.2x.%.2x.%.2x.%.2x.%.2x.%.2x\r\n",
25.                     aAPRMSG->sender_ip[0], aAPRMSG->sender_ip[1], aAPRMSG->sender_ip[2], aAPRMSG->sender_ip[3],
26.                     aAPRMSG->sender_mac[0], aAPRMSG->sender_mac[1], aAPRMSG->sender_mac[2], aAPRMSG->sender_mac[3],
27.                     aAPRMSG->sender_mac[4], aAPRMSG->sender_mac[5]);
28.  
29.             printf("%d.%d.%d.%d is at %.2x.%.2x.%.2x.%.2x.%.2x.%.2x\r\n",
30.                    aAPRMSG->sender_ip[0], aAPRMSG->sender_ip[1], aAPRMSG->sender_ip[2], aAPRMSG->sender_ip[3],
31.                    aAPRMSG->sender_mac[0], aAPRMSG->sender_mac[1], aAPRMSG->sender_mac[2], aAPRMSG->sender_mac[3],
32.                    aAPRMSG->sender_mac[4], aAPRMSG->sender_mac[5]);
33.         }
34.         else if ((aAPRMSG->opcode) == htons(ARP_REQUEST))
35.         {
36.             printf("Who has %d.%d.%d.%d ? Tell %.2x.%.2x.%.2x.%.2x.%.2x.%.2x\r\n",
37.                    aAPRMSG->tgt_ip[0], aAPRMSG->tgt_ip[1], aAPRMSG->tgt_ip[2], aAPRMSG->tgt_ip[3],
38.                    aAPRMSG->sender_mac[0], aAPRMSG->sender_mac[1], aAPRMSG->sender_mac[2], aAPRMSG->sender_mac[3],
39.                    aAPRMSG->sender_mac[4], aAPRMSG->sender_mac[5]);
40.         }
41.     }
42.     else
43.     {
44.         // printf("This message is not ARP reply: opcode is not 0x02!\r\n");
45.     }
46. } 

In this function, we will verify the received ARP message. If the ARP message is a response message and the IP address in the response matches the IP address we requested, we will set the arp_succ_flag flag to 1, indicating that the ARP request was successful.

10. Running results

After the burning routine is executed, the following can be observed: Firstly, a PHY link detection is carried out. Then, the set network address information is printed. Next, an ARP request is executed and the result is shown, as depicted in the following figure:

11 Summary

The article explains how to implement the ARP protocol on the W55MH32 chip using the MAC RAW mode, converting IP addresses into MAC addresses. It demonstrates the complete process from sending an ARP request to receiving and processing the response through practical examples. The article provides a detailed introduction to the concepts, characteristics, workflow, application scenarios, security risks and protection measures, as well as the message format of the MAC RAW mode and the ARP protocol. It helps readers understand its practical application value in local area network communication.

The next article will focus on the FTP protocol server mode, analyzing its core principles and applications in file transfer, and explaining how to set up an FTP server on related devices. Stay tuned!

WIZnet is a non-chipfoundry semiconductor company founded in 1998. Its products include the Internet processor iMCU™, which adopts TOE (TCP/IP Offloading Engine) technology and is based on a unique patented fully hardwired TCP/IP. iMCU™ is designed for embedded Internet devices in various applications.

WIZnet has over 70 distributors worldwide, with offices in Hong Kong, South Korea, and the United States, providing technical support and product marketing.

The region managed by the Hong Kong office includes: Australia, India, Turkey, and Asia (excluding South Korea and Japan).