{"id":546,"date":"2026-09-07T10:04:55","date_gmt":"2026-09-07T10:04:55","guid":{"rendered":"https:\/\/www.vps.tc\/blog\/?p=546"},"modified":"2026-09-07T09:40:07","modified_gmt":"2026-09-07T09:40:07","slug":"arp-nedir-address-resolution-protocol-nasil-calisir","status":"publish","type":"post","link":"https:\/\/www.vps.tc\/blog\/tr\/arp-nedir-address-resolution-protocol-nasil-calisir\/","title":{"rendered":"ARP Nedir? Address Resolution Protocol Nas\u0131l \u00c7al\u0131\u015f\u0131r?"},"content":{"rendered":"<div class=\"aiw-toc\" style=\"border:1px solid #dbe3ea;border-radius:8px;padding:16px 20px;margin:0 0 28px\"><strong>\u0130\u00e7indekiler<\/strong><\/p>\n<ol style=\"margin:10px 0 0;padding-left:22px\">\n<li><a href=\"#arp-nedir-ve-ne-ise-yarar\">ARP nedir ve ne i\u015fe yarar?<\/a><\/li>\n<li><a href=\"#arp-nasil-calisir\">ARP nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/a><\/li>\n<li><a href=\"#bir-cihaz-arp-tablosunu-nasil-kullanir\">Bir cihaz ARP tablosunu nas\u0131l kullan\u0131r?<\/a><\/li>\n<li><a href=\"#arp-tablosu-nasil-goruntulenir-ve-temizlenir\">ARP tablosu nas\u0131l g\u00f6r\u00fcnt\u00fclenir ve temizlenir?<\/a><\/li>\n<li><a href=\"#arp-sorunlari-nasil-teshis-edilir\">ARP sorunlar\u0131 nas\u0131l te\u015fhis edilir?<\/a><\/li>\n<li><a href=\"#arp-ile-ilgili-yaygin-sorunlar-nelerdir\">ARP ile ilgili yayg\u0131n sorunlar nelerdir?<\/a><\/li>\n<li><a href=\"#arp-ile-ipv6-komsu-kesfi-arasindaki-fark-nedir\">ARP ile IPv6 kom\u015fu ke\u015ffi aras\u0131ndaki fark nedir?<\/a><\/li>\n<li><a href=\"#arp-kullanirken-hangi-noktalar-akilda-tutulmali\">ARP kullan\u0131rken hangi noktalar ak\u0131lda tutulmal\u0131?<\/a><\/li>\n<li><a href=\"#sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/a><\/li>\n<li><a href=\"#kaynaklar\">Kaynaklar<\/a><\/li>\n<\/ol>\n<\/div>\n<h2 id=\"arp-nedir-ve-ne-ise-yarar\">ARP nedir ve ne i\u015fe yarar?<\/h2>\n<p>ARP, IPv4 a\u011flar\u0131nda bir IP adresinin hangi cihaz\u0131n MAC adresine kar\u015f\u0131l\u0131k geldi\u011fini bulmak i\u00e7in kullan\u0131lan yerel a\u011f protokol\u00fcd\u00fcr. Bilgisayar\u0131n\u0131z ayn\u0131 a\u011fdaki bir hedefe paket g\u00f6ndermeden \u00f6nce ARP iste\u011fi yay\u0131nlar; hedef cihaz MAC adresini bildirir ve i\u015fletim sistemi bu e\u015fle\u015fmeyi ge\u00e7ici olarak ARP \u00f6nbelle\u011finde saklar.<\/p>\n<p>Bir VPS&#8217;e SSH ile ba\u011fland\u0131\u011f\u0131n\u0131zda akl\u0131n\u0131zda yaln\u0131zca IP adresi vard\u0131r. Ethernet aray\u00fcz\u00fcn\u00fcn g\u00f6nderim yapabilmesi i\u00e7inse yerel a\u011fdaki bir sonraki cihaz\u0131n fiziksel adresini bilmesi gerekir. ARP tam bu noktada devreye girer. IP katman\u0131 hedefi mant\u0131ksal adresiyle tarif eder, Ethernet ise \u00e7er\u00e7eveyi MAC adresine teslim eder.<\/p>\n<p>Buradaki &#8220;fiziksel adres&#8221; ifadesi biraz eski bir al\u0131\u015fkanl\u0131k. MAC adresi donan\u0131m aray\u00fcz\u00fcyle ili\u015fkilidir; sanal makinelerde, bridge yap\u0131lar\u0131nda ve konteyner a\u011flar\u0131nda yaz\u0131l\u0131msal olarak atanabilir. Yine de IPv4 paketinin yerel Ethernet \u00fczerinde ilerlemesi i\u00e7in gereken adresleme bilgisi de\u011fi\u015fmez.<\/p>\n<h2 id=\"arp-nasil-calisir\">ARP nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/h2>\n<p>ARP yaln\u0131zca ayn\u0131 yerel a\u011f segmentindeki kom\u015fular\u0131 bulur. Uzak bir web sunucusuna ba\u011flan\u0131rken hedef sunucunun MAC adresini aramazs\u0131n\u0131z; i\u015fletim sistemi varsay\u0131lan a\u011f ge\u00e7idinin MAC adresini bulur ve IP paketini o cihaza teslim eder. Router, paketi bir sonraki a\u011f i\u00e7in yeniden \u00e7er\u00e7eveler.<\/p>\n<p>RFC 826&#8217;da tan\u0131mlanan temel ak\u0131\u015f d\u00f6rt ad\u0131mda g\u00f6r\u00fclebilir:<\/p>\n<ol>\n<li>G\u00f6nderen, hedef IP adresi i\u00e7in kendi ARP \u00f6nbelle\u011fini kontrol eder.<\/li>\n<li>E\u015fle\u015fme yoksa Ethernet yay\u0131n adresine, yani <code>ff:ff:ff:ff:ff:ff<\/code> adresine ARP Request g\u00f6nderir.<\/li>\n<li>Yerel a\u011fdaki cihazlar iste\u011fi al\u0131r; hedef IP kendisine ait olan cihaz ARP Reply ile kendi MAC adresini bildirir.<\/li>\n<li>G\u00f6nderen bu e\u015fle\u015fmeyi \u00f6nbelle\u011fe al\u0131r ve bekleyen IP paketini ilgili MAC adresine g\u00f6nderir.<\/li>\n<\/ol>\n<p>ARP Request i\u00e7indeki hedef MAC alan\u0131 hen\u00fcz bilinmedi\u011fi i\u00e7in s\u0131f\u0131rlarla doldurulur. Ethernet \u00e7er\u00e7evesinin hedefi ise yay\u0131n adresidir. ARP Reply \u00e7o\u011funlukla do\u011frudan g\u00f6nderenin MAC adresine gider; cihazlar her yan\u0131t\u0131 herkese yay\u0131nlamak zorunda de\u011fildir.<\/p>\n<h3>ARP iste\u011finde hangi bilgiler bulunur?<\/h3>\n<p>Bir ARP mesaj\u0131 yaln\u0131zca &#8220;\u015fu IP kimin?&#8221; sorusundan ibaret de\u011fildir. G\u00f6nderen ve hedef i\u00e7in donan\u0131m t\u00fcr\u00fc, protokol t\u00fcr\u00fc, donan\u0131m adresi uzunlu\u011fu, protokol adresi uzunlu\u011fu, i\u015flem tipi ve adres \u00e7iftleri ta\u015f\u0131n\u0131r. G\u00fcnl\u00fck bir IPv4\/Ethernet a\u011f\u0131nda \u00f6ne \u00e7\u0131kan alanlar \u015funlard\u0131r:<\/p>\n<table>\n<thead>\n<tr>\n<th>Alan<\/th>\n<th>Anlam\u0131<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Sender IP<\/td>\n<td>\u0130ste\u011fi veya yan\u0131t\u0131 g\u00f6nderen cihaz\u0131n IPv4 adresi<\/td>\n<\/tr>\n<tr>\n<td>Sender MAC<\/td>\n<td>G\u00f6nderen Ethernet aray\u00fcz\u00fcn\u00fcn MAC adresi<\/td>\n<\/tr>\n<tr>\n<td>Target IP<\/td>\n<td>MAC adresi \u00f6\u011frenilmek istenen IPv4 adresi<\/td>\n<\/tr>\n<tr>\n<td>Target MAC<\/td>\n<td>Request s\u0131ras\u0131nda bilinmeyen, Reply s\u0131ras\u0131nda doldurulan MAC adresi<\/td>\n<\/tr>\n<tr>\n<td>Operation<\/td>\n<td>Request veya Reply gibi i\u015flem t\u00fcr\u00fc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>ARP&#8217;nin kapsam\u0131n\u0131 do\u011fru \u00e7izmek gerekiyor: ARP DNS de\u011fildir. DNS, alan ad\u0131n\u0131 IP adresine \u00e7evirmeye \u00e7al\u0131\u015f\u0131r; ARP ise zaten bilinen bir IPv4 adresinin yerel a\u011fdaki MAC kar\u015f\u0131l\u0131\u011f\u0131n\u0131 arar. Bu ayr\u0131m\u0131 bir kez yanl\u0131\u015f kurdu\u011funuzda a\u011f sorunlar\u0131n\u0131 \u00e7\u00f6zmek gereksiz yere zorla\u015f\u0131r.<\/p>\n<h2 id=\"bir-cihaz-arp-tablosunu-nasil-kullanir\">Bir cihaz ARP tablosunu nas\u0131l kullan\u0131r?<\/h2>\n<p>Linux&#8217;ta ARP kay\u0131tlar\u0131n\u0131 g\u00fcn\u00fcm\u00fczde <code>ip neigh<\/code> komutuyla g\u00f6r\u00fcr\u00fcz. Eski sistemlerde <code>arp -n<\/code> veya <code>arp -a<\/code> komutlar\u0131na rastlayabilirsiniz; ancak <code>iproute2<\/code> ara\u00e7lar\u0131, IPv4 ARP ve IPv6 kom\u015fu ke\u015ffi kay\u0131tlar\u0131n\u0131 daha tutarl\u0131 bi\u00e7imde g\u00f6sterir.<\/p>\n<pre><code>ip neigh show<\/code><\/pre>\n<p>\u00d6rnek bir \u00e7\u0131kt\u0131 \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n<pre><code>192.168.1.1 dev eth0 lladdr 9c:5c:8e:12:34:56 REACHABLE\n192.168.1.42 dev eth0 lladdr 08:00:27:ab:cd:ef STALE\n192.168.1.77 dev eth0 INCOMPLETE<\/code><\/pre>\n<p><code>dev eth0<\/code>, kayd\u0131n hangi aray\u00fczde bulundu\u011funu; <code>lladdr<\/code>, yani link-layer address, MAC adresini g\u00f6sterir. <code>REACHABLE<\/code> kayd\u0131n yak\u0131n zamanda do\u011fruland\u0131\u011f\u0131n\u0131, <code>STALE<\/code> kayd\u0131n s\u00fcresinin dolmu\u015f olabilece\u011fini ama hen\u00fcz hatal\u0131 kabul edilmedi\u011fini anlat\u0131r. <code>INCOMPLETE<\/code> ise ARP \u00e7\u00f6z\u00fcmlemesinin hen\u00fcz tamamlanmad\u0131\u011f\u0131n\u0131 veya yan\u0131t al\u0131namad\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/p>\n<p>Bu durumlar Linux&#8217;un kom\u015fu \u00f6nbelle\u011fi i\u00e7in kulland\u0131\u011f\u0131 durum makinesinin par\u00e7as\u0131d\u0131r. Kay\u0131t sonsuza kadar ayn\u0131 halde kalmaz. \u00c7ekirdek, ba\u011flant\u0131n\u0131n kullan\u0131l\u0131p kullan\u0131lmad\u0131\u011f\u0131n\u0131 ve yeniden do\u011frulama gerekip gerekmedi\u011fini izler.<\/p>\n<h3>ARP \u00f6nbelle\u011fi ne kadar s\u00fcre tutulur?<\/h3>\n<p>Tek bir &#8220;ARP her 60 saniyede silinir&#8221; kural\u0131 vermek do\u011fru de\u011fildir. S\u00fcreler i\u015fletim sistemi, \u00e7ekirdek s\u00fcr\u00fcm\u00fc, da\u011f\u0131t\u0131m ve a\u011f ayarlar\u0131na g\u00f6re de\u011fi\u015febilir. Linux&#8217;ta kom\u015fu davran\u0131\u015f\u0131 <code>\/proc\/sys\/net\/ipv4\/neigh\/<\/code> alt\u0131ndaki ayarlarla ili\u015fkilidir; aray\u00fcz baz\u0131ndaki de\u011ferleri g\u00f6rmek i\u00e7in \u015fu komutu kullanabilirsiniz:<\/p>\n<pre><code>sysctl -a 2&gt;\/dev\/null | grep 'net.ipv4.neigh.*base_reachable_time'<\/code><\/pre>\n<p>Bu sat\u0131rdaki filtre, ilgili ayar\u0131 farkl\u0131 aray\u00fczler i\u00e7in birlikte g\u00f6rmenizi sa\u011flar. De\u011ferleri de\u011fi\u015ftirirken rastgele bir say\u0131 yazmak yerine da\u011f\u0131t\u0131m\u0131n ve uygulaman\u0131n a\u011f davran\u0131\u015f\u0131n\u0131 \u00f6l\u00e7mek gerekir. ARP \u00f6nbelle\u011fi performans i\u00e7in vard\u0131r; her paket \u00f6ncesi yay\u0131n yap\u0131lmas\u0131n\u0131 engeller. \u00c7ok k\u0131sa s\u00fcreler gereksiz ARP trafi\u011fi \u00fcretir, \u00e7ok uzun s\u00fcrelerse IP-MAC de\u011fi\u015fikliklerinin ge\u00e7 fark edilmesine yol a\u00e7abilir.<\/p>\n<h2 id=\"arp-tablosu-nasil-goruntulenir-ve-temizlenir\">ARP tablosu nas\u0131l g\u00f6r\u00fcnt\u00fclenir ve temizlenir?<\/h2>\n<p>\u0130lk kontrol\u00fcm genellikle hedef IP&#8217;nin hangi aray\u00fcz ve MAC adresiyle e\u015fle\u015fti\u011fidir. \u00d6rne\u011fin varsay\u0131lan a\u011f ge\u00e7idini g\u00f6rmek i\u00e7in:<\/p>\n<pre><code>ip route get 8.8.8.8<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131 \u00e7o\u011fu Linux sunucuda buna benzer:<\/p>\n<pre><code>8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.20 uid 0<\/code><\/pre>\n<p>Bu \u00e7\u0131kt\u0131, internet \u00fczerindeki <code>8.8.8.8<\/code> adresine do\u011frudan ARP sorulmayaca\u011f\u0131n\u0131 g\u00f6sterir. Yerel a\u011f ge\u00e7idi <code>192.168.1.1<\/code> oldu\u011fu i\u00e7in ARP sorgusu onun i\u00e7in yap\u0131lacakt\u0131r. Ard\u0131ndan ilgili kayd\u0131 \u015fu \u015fekilde kontrol ederim:<\/p>\n<pre><code>ip neigh show 192.168.1.1 dev eth0<\/code><\/pre>\n<p>Gerekirse belirli bir kayd\u0131 silip yeniden \u00f6\u011frenilmesini sa\u011flayabilirsiniz:<\/p>\n<pre><code>sudo ip neigh del 192.168.1.1 dev eth0<\/code><\/pre>\n<p>Bu sat\u0131rdaki <code>dev eth0<\/code> \u00f6nemli; ayn\u0131 IP farkl\u0131 aray\u00fczlerde bulunabilir. Ayr\u0131ca kay\u0131t silmek fiziksel ar\u0131zay\u0131 onarmaz. Anahtar portu kapal\u0131ysa, VLAN yanl\u0131\u015fsa veya kar\u015f\u0131 cihaz yan\u0131t vermiyorsa yeni ARP sorgusu da yan\u0131ts\u0131z kalacakt\u0131r.<\/p>\n<p>Bir aray\u00fczdeki kom\u015fu kay\u0131tlar\u0131n\u0131 topluca temizlemek i\u00e7in \u015fu komut kullan\u0131labilir:<\/p>\n<pre><code>sudo ip neigh flush dev eth0<\/code><\/pre>\n<p>Ben bunu \u00fcretim sunucusunda ilk refleks olarak \u00e7al\u0131\u015ft\u0131rmam. \u00d6nce <code>ip route<\/code>, <code>ip addr<\/code>, switch veya sanalla\u015ft\u0131rma katman\u0131ndaki durum ve ilgili \u00e7ekirdek loglar\u0131 kontrol edilir. Komut k\u0131sa, etkisi bazen beklenenden geni\u015ftir.<\/p>\n<h2 id=\"arp-sorunlari-nasil-teshis-edilir\">ARP sorunlar\u0131 nas\u0131l te\u015fhis edilir?<\/h2>\n<p>Bir sunucuya eri\u015femedi\u011finizde <code>ping<\/code> ba\u015far\u0131s\u0131z olabilir; fakat ping yan\u0131t\u0131 olmamas\u0131 tek ba\u015f\u0131na ARP ar\u0131zas\u0131 kan\u0131t\u0131 de\u011fildir. G\u00fcvenlik duvar\u0131 ICMP&#8217;yi engelliyor olabilir, servis kapal\u0131 olabilir veya hedef ba\u015fka bir a\u011fda bulunabilir. Bu y\u00fczden katmanlar\u0131 birbirinden ay\u0131rarak ilerlemek gerekir.<\/p>\n<h3>1. Yerel adres ve rota kontrol\u00fc<\/h3>\n<pre><code>ip addr show dev eth0\nip route show<\/code><\/pre>\n<p>\u00d6nce sunucunun beklenen IPv4 adresini ger\u00e7ekten ta\u015f\u0131y\u0131p ta\u015f\u0131mad\u0131\u011f\u0131na bakar\u0131m. Ard\u0131ndan hedef i\u00e7in do\u011fru aray\u00fcz ve a\u011f ge\u00e7idinin se\u00e7ildi\u011fini kontrol ederim. Yanl\u0131\u015f netmask, beklenmedik bir yerel rota veya eksik varsay\u0131lan rota ARP san\u0131lan sorunlar\u0131n s\u0131k nedenlerindendir.<\/p>\n<h3>2. Kom\u015fu durumunu inceleme<\/h3>\n<pre><code>ip neigh show dev eth0<\/code><\/pre>\n<p><code>FAILED<\/code> veya uzun s\u00fcre <code>INCOMPLETE<\/code> kalan bir kay\u0131t, ARP yan\u0131t\u0131 al\u0131namad\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnd\u00fcr\u00fcr. Ayn\u0131 a\u011fdaki bir ba\u015fka cihaz\u0131n MAC adresi \u00f6\u011frenilebiliyor, yaln\u0131zca tek hedef \u00f6\u011frenilemiyorsa hedefin aray\u00fcz\u00fc, IP yap\u0131land\u0131rmas\u0131 veya g\u00fcvenlik politikas\u0131 incelenmelidir.<\/p>\n<h3>3. Paketleri ger\u00e7ekten g\u00f6rmek<\/h3>\n<pre><code>sudo tcpdump -ni eth0 arp<\/code><\/pre>\n<p><code>-n<\/code> DNS \u00e7\u00f6z\u00fcmlemesini kapat\u0131r, <code>-i eth0<\/code> dinlenecek aray\u00fcz\u00fc belirler. Bekledi\u011finiz durumda <code>who-has<\/code> bi\u00e7iminde bir ARP Request ve ard\u0131ndan <code>is-at<\/code> bi\u00e7iminde bir Reply g\u00f6r\u00fcrs\u00fcn\u00fcz. Request \u00e7\u0131k\u0131yor ama Reply d\u00f6nm\u00fcyorsa a\u011f yolu ya da hedef taraf\u0131 ara\u015ft\u0131r\u0131l\u0131r; Reply d\u00f6n\u00fcyor fakat uygulama trafi\u011fi yoksa sorun ARP katman\u0131n\u0131n d\u0131\u015f\u0131na ta\u015fm\u0131\u015ft\u0131r.<\/p>\n<p>Benzer bir kontrol\u00fc daha geni\u015f filtreyle de yapabilirsiniz:<\/p>\n<pre><code>sudo tcpdump -ni any 'arp or icmp'<\/code><\/pre>\n<p>Burada <code>any<\/code> sanal bir dinleme se\u00e7ene\u011fidir; fiziksel aray\u00fcz ad\u0131n\u0131 yazmad\u0131\u011f\u0131n\u0131z i\u00e7in birden fazla aray\u00fcz\u00fcn trafi\u011fini birlikte g\u00f6r\u00fcrs\u00fcn\u00fcz. Yo\u011fun sunucularda \u00e7\u0131kt\u0131 h\u0131zla b\u00fcy\u00fcyebilir, bu nedenle k\u0131sa s\u00fcreli kullanmak daha sa\u011fl\u0131kl\u0131d\u0131r.<\/p>\n<h3>4. VLAN, bridge ve sanal a\u011flar\u0131 kontrol etmek<\/h3>\n<p>VPS altyap\u0131lar\u0131nda ARP trafi\u011fi yaln\u0131zca fiziksel kabloyla s\u0131n\u0131rl\u0131 de\u011fildir. Linux bridge, VLAN, hypervisor ve sanal switch ayn\u0131 yerel a\u011f\u0131n nas\u0131l kuruldu\u011funu belirler. VPS&#8217;iniz ayn\u0131 subnet&#8217;teki ba\u015fka bir adrese ula\u015fam\u0131yorsa hosting panelindeki a\u011f yap\u0131land\u0131rmas\u0131, sanal NIC durumu ve sa\u011flay\u0131c\u0131n\u0131n anti-spoofing kurallar\u0131 incelenmelidir.<\/p>\n<p>Bir gece vardiyas\u0131nda m\u00fc\u015fterinin failover IP&#8217;si yeni sunucuya ta\u015f\u0131nd\u0131ktan sonra ba\u011flant\u0131lar\u0131n bir b\u00f6l\u00fcm\u00fcn\u00fcn eski makineye gitti\u011fini g\u00f6rm\u00fc\u015ft\u00fcm. Uygulama loglar\u0131na bak\u0131nca servis sa\u011fl\u0131kl\u0131yd\u0131; <code>ip neigh<\/code> \u00e7\u0131kt\u0131s\u0131ndaki MAC adresi ise eski node&#8217;u g\u00f6steriyordu. Kayd\u0131 silmeden \u00f6nce switch MAC tablosunu ve sanal IP duyurusunu kontrol ettim. Yeni node&#8217;un gratuitous ARP g\u00f6ndermedi\u011fi ortaya \u00e7\u0131kt\u0131. Duyuruyu do\u011fru aray\u00fczden yapt\u0131ktan sonra istemciler yeni MAC adresini \u00f6\u011frenmeye ba\u015flad\u0131. O olaydan beri ARP kayd\u0131n\u0131 silmeyi \u00e7\u00f6z\u00fcm de\u011fil, g\u00f6zlem ad\u0131m\u0131 olarak g\u00f6r\u00fcyorum.<\/p>\n<h2 id=\"arp-ile-ilgili-yaygin-sorunlar-nelerdir\">ARP ile ilgili yayg\u0131n sorunlar nelerdir?<\/h2>\n<h3>Stale veya yanl\u0131\u015f ARP kayd\u0131<\/h3>\n<p>Bir IP adresi ba\u015fka bir aray\u00fcze ta\u015f\u0131nd\u0131\u011f\u0131nda ya da y\u00fcksek eri\u015filebilirlik yap\u0131s\u0131nda sanal IP farkl\u0131 bir node&#8217;a ge\u00e7ti\u011finde eski MAC e\u015fle\u015fmesi k\u0131sa s\u00fcre sorun yaratabilir. Normalde yeni ARP duyurular\u0131 ve yeniden do\u011frulama s\u00fcreci kay\u0131tlar\u0131 g\u00fcnceller. H\u0131zl\u0131 ge\u00e7i\u015f gereken ortamlarda cihazlar\u0131n gratuitous ARP g\u00f6ndermesi bu s\u00fcreci h\u0131zland\u0131rabilir; a\u011f cihazlar\u0131n\u0131n g\u00fcvenlik politikalar\u0131 bunu k\u0131s\u0131tlayabilir.<\/p>\n<p>Belirti, \u00e7o\u011fu zaman ayn\u0131 subnet&#8217;teki baz\u0131 cihazlar\u0131n yeni node&#8217;a, baz\u0131lar\u0131n\u0131n eski node&#8217;a gitmesidir. Tek bir istemcide kayd\u0131 temizlemek ge\u00e7ici bir te\u015fhis ad\u0131m\u0131 olabilir. Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm i\u00e7in failover mekanizmas\u0131n\u0131n ARP duyurusunu, switch davran\u0131\u015f\u0131n\u0131 ve sanal IP tasar\u0131m\u0131n\u0131 birlikte incelemek gerekir.<\/p>\n<h3>ARP yay\u0131nlar\u0131n\u0131n artmas\u0131<\/h3>\n<p>ARP broadcast oldu\u011fu i\u00e7in yerel segmentteki cihazlar iste\u011fi al\u0131r. Normal bir a\u011fda bu trafik y\u00f6netilebilir d\u00fczeydedir; geni\u015f ve yo\u011fun broadcast domain&#8217;lerinde gereksiz yay\u0131nlar sorun \u00e7\u0131karabilir. Subnet&#8217;leri do\u011fru b\u00f6lmek, hatal\u0131 \u00e7al\u0131\u015fan cihaz\u0131 bulmak ve ARP isteklerinin kayna\u011f\u0131n\u0131 paket yakalamayla belirlemek daha do\u011fru yakla\u015f\u0131md\u0131r.<\/p>\n<h3>ARP spoofing ve ARP poisoning<\/h3>\n<p>ARP, yerel a\u011fdaki yan\u0131tlar\u0131n kimli\u011fini g\u00fc\u00e7l\u00fc bi\u00e7imde do\u011frulayan bir mekanizma de\u011fildir. K\u00f6t\u00fc niyetli bir cihaz, a\u011f ge\u00e7idinin IP adresi i\u00e7in kendi MAC adresini bildirerek trafi\u011fi \u00fczerine \u00e7ekmeye \u00e7al\u0131\u015fabilir. Bu sald\u0131r\u0131 ARP spoofing veya ARP poisoning olarak adland\u0131r\u0131l\u0131r ve ayn\u0131 yerel a\u011f segmentindeki trafi\u011fi etkileyebilir.<\/p>\n<p>Sunucu taraf\u0131nda kullan\u0131labilecek \u00f6nlemler ortam\u0131n yap\u0131s\u0131na ba\u011fl\u0131d\u0131r:<\/p>\n<ul>\n<li>Y\u00f6netilebilir switch \u00fczerinde DHCP snooping ve Dynamic ARP Inspection destekleniyorsa do\u011fru bi\u00e7imde yap\u0131land\u0131r\u0131labilir.<\/li>\n<li>G\u00fcvenilir a\u011f ge\u00e7idi i\u00e7in statik kom\u015fu kayd\u0131 baz\u0131 k\u00fc\u00e7\u00fck ve kontroll\u00fc a\u011flarda kullan\u0131labilir; b\u00fcy\u00fck ortamlarda bak\u0131m y\u00fck\u00fc olu\u015fturur.<\/li>\n<li>Y\u00f6netim eri\u015fimi m\u00fcmk\u00fcn oldu\u011funca g\u00fcvenilir a\u011flardan veya WireGuard gibi \u015fifreli t\u00fcnellerden yap\u0131labilir.<\/li>\n<li>\u015e\u00fcpheli de\u011fi\u015fikliklerde <code>ip neigh<\/code> \u00e7\u0131kt\u0131s\u0131, switch MAC tablosu ve paket yakalama birlikte de\u011ferlendirilmelidir.<\/li>\n<\/ul>\n<p>Sunucunun SSH portunu de\u011fi\u015ftirmek tek ba\u015f\u0131na bu sald\u0131r\u0131y\u0131 \u00e7\u00f6zmez. A\u011f\u0131n g\u00fcven s\u0131n\u0131r\u0131n\u0131, y\u00f6netim yollar\u0131n\u0131 ve switch kontrollerini d\u00fc\u015f\u00fcnmek gerekir; port numaras\u0131n\u0131 de\u011fi\u015ftirmek bazen yaln\u0131zca loglar\u0131 sessizle\u015ftirir.<\/p>\n<h2 id=\"arp-ile-ipv6-komsu-kesfi-arasindaki-fark-nedir\">ARP ile IPv6 kom\u015fu ke\u015ffi aras\u0131ndaki fark nedir?<\/h2>\n<p>ARP, IPv4 i\u00e7in kullan\u0131l\u0131r. IPv6&#8217;da ayn\u0131 i\u015f i\u00e7in Neighbor Discovery Protocol, yani NDP kullan\u0131l\u0131r ve bu mekanizma ICMPv6 \u00fczerine kuruludur. NDP; kom\u015fu adres \u00e7\u00f6z\u00fcmlemesinin yan\u0131nda router discovery, address autoconfiguration ve duplicate address detection gibi g\u00f6revleri de kapsar.<\/p>\n<table>\n<thead>\n<tr>\n<th>\u00d6zellik<\/th>\n<th>IPv4 ARP<\/th>\n<th>IPv6 NDP<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u00c7al\u0131\u015ft\u0131\u011f\u0131 protokol<\/td>\n<td>IPv4<\/td>\n<td>IPv6<\/td>\n<\/tr>\n<tr>\n<td>Ta\u015f\u0131ma yakla\u015f\u0131m\u0131<\/td>\n<td>Ethernet \u00fczerinde ARP mesajlar\u0131<\/td>\n<td>ICMPv6 mesajlar\u0131<\/td>\n<\/tr>\n<tr>\n<td>Yay\u0131n davran\u0131\u015f\u0131<\/td>\n<td>Broadcast kullan\u0131labilir<\/td>\n<td>Multicast tabanl\u0131 kom\u015fu ke\u015ffi<\/td>\n<\/tr>\n<tr>\n<td>Linux kontrol\u00fc<\/td>\n<td><code>ip neigh<\/code><\/td>\n<td><code>ip -6 neigh<\/code><\/td>\n<\/tr>\n<tr>\n<td>Adres \u00e7ak\u0131\u015fmas\u0131 kontrol\u00fc<\/td>\n<td>ARP probe gibi y\u00f6ntemler<\/td>\n<td>Duplicate Address Detection<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>IPv6 kullanan bir sunucuda yaln\u0131zca <code>ip neigh<\/code> komutunun IPv4 \u00e7\u0131kt\u0131s\u0131na bakmak eksik te\u015fhistir. IPv6 kom\u015fular\u0131n\u0131 ayr\u0131ca g\u00f6rmek i\u00e7in:<\/p>\n<pre><code>ip -6 neigh show dev eth0<\/code><\/pre>\n<p>IPv6 ba\u011flant\u0131lar\u0131nda g\u00f6r\u00fclen bir eri\u015fim sorununun ARP ile a\u00e7\u0131klanamamas\u0131n\u0131n nedeni budur. Burada NDP, ICMPv6 filtreleri ve router advertisement davran\u0131\u015f\u0131 incelenmelidir.<\/p>\n<h2 id=\"arp-kullanirken-hangi-noktalar-akilda-tutulmali\">ARP kullan\u0131rken hangi noktalar ak\u0131lda tutulmal\u0131?<\/h2>\n<ul>\n<li>ARP yaln\u0131zca IPv4 kom\u015fu \u00e7\u00f6z\u00fcmlemesi yapar; DNS&#8217;in veya y\u00f6nlendirme protokol\u00fcn\u00fcn yerine ge\u00e7mez.<\/li>\n<li>Uzak hedeflerde \u00e7o\u011fu zaman hedef sunucunun de\u011fil, varsay\u0131lan a\u011f ge\u00e7idinin MAC adresi \u00e7\u00f6z\u00fcl\u00fcr.<\/li>\n<li><code>STALE<\/code> kayd\u0131 tek ba\u015f\u0131na ar\u0131za anlam\u0131na gelmez; Linux gerekti\u011finde kayd\u0131 yeniden do\u011frulayabilir.<\/li>\n<li><code>INCOMPLETE<\/code> ve <code>FAILED<\/code> durumlar\u0131, ARP yan\u0131t\u0131 al\u0131namad\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcnd\u00fcr\u00fcr; fiziksel, sanal ve g\u00fcvenlik katmanlar\u0131 birlikte kontrol edilmelidir.<\/li>\n<li>ARP tablosunu temizlemek te\u015fhis arac\u0131d\u0131r, genel bir onar\u0131m y\u00f6ntemi de\u011fildir.<\/li>\n<li>VLAN, bridge ve hypervisor yap\u0131land\u0131rmalar\u0131 ARP&#8217;nin ula\u015f\u0131p ula\u015famayaca\u011f\u0131n\u0131 do\u011frudan etkiler.<\/li>\n<li>IPv6 sorunlar\u0131nda ARP yerine NDP komutlar\u0131n\u0131 ve ICMPv6 trafi\u011fini incelemek gerekir.<\/li>\n<\/ul>\n<p>IP adreslerinin nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 daha geni\u015f \u00e7er\u00e7evede g\u00f6rmek isterseniz <strong><a href=\"https:\/\/www.vps.tc\/blog\/tr\/ip-adresi-nedir-ne-ise-yarar-nasil-ogrenilir\/\">IP Adresi Nedir? Ne \u0130\u015fe Yarar ve Nas\u0131l \u00d6\u011frenilir?<\/a><\/strong> yaz\u0131s\u0131na, ARP&#8217;nin TCP\/IP i\u00e7indeki yerini anlamak i\u00e7in de <strong><a href=\"https:\/\/www.vps.tc\/blog\/tr\/internet-protokolleri-tcp-ipden-http-3e-derinlemesine-bakis\/\">\u0130nternet Protokolleri: TCP\/IP&#8217;den HTTP\/3&#8217;e Derinlemesine Bak\u0131\u015f<\/a><\/strong> i\u00e7eri\u011fine bakabilirsiniz. Ben a\u011f ar\u0131zalar\u0131nda \u00f6nce hedefin ayn\u0131 subnet&#8217;te olup olmad\u0131\u011f\u0131n\u0131, sonra a\u011f ge\u00e7idi MAC adresini ve en son uygulamay\u0131 kontrol ediyorum. Bu s\u0131ra, gereksiz servis yeniden ba\u015flatmalar\u0131ndan \u00e7ok daha az g\u00fcr\u00fclt\u00fcl\u00fc.<\/p>\n<h2 id=\"sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/h2>\n<h3>ARP nedir, k\u0131saca ne yapar?<\/h3>\n<p>ARP, bir IPv4 adresinin yerel a\u011fdaki MAC adresini bulur. Cihazlar bu e\u015fle\u015fmeyi ge\u00e7ici olarak \u00f6nbelle\u011fe al\u0131r ve IP paketlerini Ethernet \u00e7er\u00e7eveleri i\u00e7inde do\u011fru kom\u015fuya g\u00f6nderir.<\/p>\n<h3>ARP tablosu nas\u0131l g\u00f6r\u00fcnt\u00fclenir?<\/h3>\n<p>Linux&#8217;ta <code>ip neigh show<\/code> komutu IPv4 kom\u015fu kay\u0131tlar\u0131n\u0131 g\u00f6sterir. Belirli bir aray\u00fcz\u00fc incelemek i\u00e7in <code>ip neigh show dev eth0<\/code> kullanabilirsiniz.<\/p>\n<h3>ARP tablosunu temizlemek ba\u011flant\u0131 sorununu \u00e7\u00f6zer mi?<\/h3>\n<p>Bazen eski veya yanl\u0131\u015f bir MAC e\u015fle\u015fmesini yeniden \u00f6\u011frenmeye zorlayarak te\u015fhise yard\u0131mc\u0131 olur. Fakat VLAN, bridge, switch veya kar\u015f\u0131 cihaz kaynakl\u0131 bir sorun varsa kay\u0131t silmek kal\u0131c\u0131 \u00e7\u00f6z\u00fcm sa\u011flamaz.<\/p>\n<h3>IPv6&#8217;da ARP kullan\u0131l\u0131r m\u0131?<\/h3>\n<p>Hay\u0131r. IPv6, kom\u015fu adres \u00e7\u00f6z\u00fcmlemesi ve ilgili ke\u015fif i\u015flemleri i\u00e7in Neighbor Discovery Protocol kullan\u0131r. Linux&#8217;ta IPv6 kom\u015fular\u0131n\u0131 <code>ip -6 neigh show<\/code> komutuyla g\u00f6rebilirsiniz.<\/p>\n<h2 id=\"kaynaklar\">Kaynaklar<\/h2>\n<ul class=\"aiw-sources\">\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc826\" target=\"_blank\" rel=\"noopener nofollow\">RFC 826 &#8211; An Ethernet Address Resolution Protocol<\/a> \u2014 rfc-editor.org<\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc4861\" target=\"_blank\" rel=\"noopener nofollow\">RFC 4861 &#8211; IPv6 Neighbor Discovery<\/a> \u2014 rfc-editor.org<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>ARP&#8217;nin IPv4 a\u011flar\u0131nda IP adreslerini MAC adresleriyle nas\u0131l e\u015fle\u015ftirdi\u011fini, Linux&#8217;ta nas\u0131l g\u00f6r\u00fcnt\u00fclenece\u011fini ve sorunlar\u0131n nas\u0131l te\u015fhis edilece\u011fini anlat\u0131yorum.<\/p>\n","protected":false},"author":2,"featured_media":543,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[279],"tags":[1764,1760,1656,1660,1762,1766],"class_list":["post-546","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nedir","tag-ag-sorun-giderme","tag-arp","tag-ipv4","tag-linux-ag-yonetimi","tag-mac-adresi","tag-ndp"],"lang":"tr","translations":{"tr":546,"en":547},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/comments?post=546"}],"version-history":[{"count":1,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/546\/revisions"}],"predecessor-version":[{"id":548,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/546\/revisions\/548"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media\/543"}],"wp:attachment":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media?parent=546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/categories?post=546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/tags?post=546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}