Page 769 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

multiple specific recipients. (RFC 1112 discusses the requirements to
perform IGMP multicasting.) IGMP is used by IP hosts to register

their dynamic multicast group membership. It is also used by
connected routers to discover these groups. Through the use of IGMP
multicasting, a server can initially transmit a single data signal for the
entire group rather than a separate initial data signal for each
intended recipient. With IGMP, the single initial signal is multiplied at
the router if divergent pathways exist to the intended recipients. The
IP header protocol field value for IGMP is 2 (0x02).

ARP Address Resolution Protocol (ARP) is essential to the
interoperability of logical and physical addressing schemes. ARP is
used to resolve IP addresses (32-bit binary number for logical
addressing) into Media Access Control (MAC) addresses (48-bit binary
number for physical addressing)—or EUI-48 or even EUI-64. Traffic
on a network segment (for example, cables across a hub) is directed
from its source system to its destination system using MAC addresses.

ARP uses caching and broadcasting to perform its operations. The first
step in resolving an IP address into a MAC address, or vice versa, is to
check the local ARP cache. If the needed information is already
present in the ARP cache, it is used. This activity is sometimes abused
using a technique called ARP cache poisoning, where an attacker
inserts bogus information into the ARP cache. If the ARP cache does

not contain the necessary information, an ARP request in the form of a
broadcast is transmitted. If the owner of the queried address is in the
local subnet, it can respond with the necessary information. If not, the
system will default to using its default gateway to transmit its
communications. Then, the default gateway (in other words, a router)
will need to perform its own ARP process.

Common Application Layer Protocols
In the Application layer of the TCP/IP model (which includes the

Session, Presentation, and Application layers of the OSI model) reside
numerous application- or service-specific protocols. A basic
knowledge of these protocols and their relevant service ports is
important for the CISSP exam: