2 cissp ® Official Study Guide Eighth Edition

Type
Function
0
Echo reply
3
Destination unreachable
5
Redirect
8
Echo request
9
Router advertisement
10
Router solicitation
11
Time exceeded
IGMP Internet Group Management Protocol (IGMP) 
allows systems to support multi-
casting. Multicasting is the transmission of data to multiple specific recipients. (RFC 1112 
discusses the requirements to perform IGMP multicasting.) IGMP is used by IP hosts to 
register their dynamic multicast group membership. It is also used by connected routers to 
discover these groups. Through the use of IGMP multicasting, a server can initially trans-
mit a single data signal for the entire group rather than a separate initial data signal for 
each intended recipient. With IGMP, the single initial signal is multiplied at the router if 
divergent pathways exist to the intended recipients. The IP header protocol field value for 
IGMP is 2 (0x02).
ARP Address Resolution Protocol (ARP)
is essential to the interoperability of logical and 
physical addressing schemes. ARP is used to resolve IP addresses (32-bit binary number 
for logical addressing) into Media Access Control (MAC) addresses (48-bit binary number 
for physical addressing)—or EUI-48 or even EUI-64. Traffic on a network segment (for 
example, cables across a hub) is directed from its source system to its destination system 
using MAC addresses.
ARP uses caching and broadcasting to perform its operations. The first step in resolving an 
IP address into a MAC address, or vice versa, is to check the local ARP cache. If the needed 
information is already present in the ARP cache, it is used. This activity is sometimes 

---

462
Chapter 11 
■
Secure Network Architecture and Securing Network Components
abused using a technique called 
ARP cache poisoning
, where an attacker inserts bogus 
information into the ARP cache. If the ARP cache does not contain the necessary informa-
tion, an ARP request in the form of a broadcast is transmitted. If the owner of the queried 
address is in the local subnet, it can respond with the necessary information. If not, the 
system will default to using its default gateway to transmit its communications. Then, the 
default gateway (in other words, a router) will need to perform its own ARP process.