Appearance
ARP (Address Resolution Protocol)
ARP is used to map a known IP address → unknown MAC address within a LAN. It operates at the boundary of Layer 2 and Layer 3.
Why ARP Is Needed
- IP works at Layer 3, but actual data delivery on a LAN happens at Layer 2 using MAC addresses.
- When a device wants to send data, it knows the destination IP but needs the destination MAC.
- ARP solves this.
How ARP Works
Host A wants to send data to 192.168.1.5:
- ARP Request — A broadcasts to
FF:FF:FF:FF:FF:FF:"Who has 192.168.1.5? Tell 192.168.1.1"
- ARP Reply — The device with that IP responds unicast:
"192.168.1.5 is at AA:BB:CC:DD:EE:FF"
- A caches the mapping in its ARP Table and sends the frame.
ARP Table (ARP Cache)
- Stores IP → MAC mappings temporarily.
- Entries expire after a timeout (usually ~20 min).
- View it with
arp -aon Windows/Linux.
ARP Message Types
| Type | Description |
|---|---|
| ARP Request | Broadcast asking for MAC |
| ARP Reply | Unicast response with MAC |
| Gratuitous ARP | Device announces its own IP→MAC (used in failover, IP conflict detection) |
| Proxy ARP | Router replies on behalf of another device |
ARP Vulnerabilities
- ARP Spoofing / ARP Poisoning — Attacker sends fake ARP replies to poison ARP caches, redirecting traffic through themselves (Man-in-the-Middle attack).
- ARP has no authentication — it trusts all replies.
ARP vs RARP
| ARP | RARP | |
|---|---|---|
| Resolves | IP → MAC | MAC → IP |
| Used by | All devices | Diskless workstations (obsolete) |
Important: ARP works only within a single LAN (doesn't cross routers). When sending to a different network, ARP resolves the router's MAC, not the final destination's MAC.