ARP — Address Resolution Protocol
BeginnerARP resolves an IP address to a MAC address on a local network segment. Without ARP, a host knows where to send a packet logically (IP) but not physically (MAC address of the next hop).
Overview
IP routing delivers packets to the correct network, but within a LAN, packets are delivered using MAC addresses at Layer 2. ARP bridges the gap: given an IP address, find the MAC address of that device on the same network segment. When a host wants to send a packet to 192.168.1.10, it broadcasts an ARP Request ("who has 192.168.1.10?"). The device with that IP responds with an ARP Reply containing its MAC address. The sender caches this mapping in its ARP table (also called ARP cache) and uses the MAC address to construct the Ethernet frame. ARP entries expire after a few minutes. For default gateway traffic (packets destined outside the subnet), the host ARPs for the router's MAC address — the router then handles onward routing. IPv6 replaces ARP with Neighbour Discovery Protocol (NDP), which uses ICMPv6. Gratuitous ARP is used to announce a new or changed IP-to-MAC mapping — exploited in ARP spoofing attacks.
ARP Request and Reply
ARP operates at the boundary of Layer 2 and Layer 3. The request is broadcast (sent to everyone on the LAN); the reply is unicast (sent only to the requester). The ARP cache reduces broadcast traffic by remembering recent mappings.
// ARP in action — host A (10.0.1.5) sends to host B (10.0.1.10):
//
// 1. Host A checks ARP cache — no entry for 10.0.1.10
//
// 2. ARP Request (broadcast):
// Src MAC: AA:BB:CC:DD:EE:01 (Host A)
// Dst MAC: FF:FF:FF:FF:FF:FF (broadcast — everyone on LAN)
// Src IP: 10.0.1.5
// Target IP: 10.0.1.10
// "Who has 10.0.1.10? Tell 10.0.1.5"
//
// 3. Host B receives broadcast, recognises its IP, sends ARP Reply (unicast):
// Src MAC: AA:BB:CC:DD:EE:02 (Host B)
// Dst MAC: AA:BB:CC:DD:EE:01 (Host A)
// "10.0.1.10 is at AA:BB:CC:DD:EE:02"
//
// 4. Host A caches: 10.0.1.10 → AA:BB:CC:DD:EE:02 (TTL ~20 min)
// 5. Host A constructs Ethernet frame with dst MAC = AA:BB:CC:DD:EE:02
// View ARP cache on Linux/Mac:
// arp -n → show ARP table
// ip neigh show → modern equivalent
// Example output:
// 10.0.1.10 dev eth0 lladdr aa:bb:cc:dd:ee:02 REACHABLE
// 10.0.1.1 dev eth0 lladdr 00:50:56:c0:00:08 REACHABLE ← default gatewayGratuitous ARP and ARP Spoofing
Gratuitous ARP is an unsolicited ARP reply — a host announces its own MAC. Used for IP failover (virtual IPs) and after a NIC change. ARP spoofing exploits the trust model of ARP to perform man-in-the-middle attacks.
// Gratuitous ARP — used for virtual IP failover:
// Primary server fails → standby sends Gratuitous ARP:
// "10.0.1.100 is now at AA:BB:CC:DD:EE:99" (new MAC for same VIP)
// All hosts on LAN update their ARP cache immediately
// Traffic seamlessly redirects to standby — used by keepalived, HSRP, VRRP
// ARP Spoofing attack (Man-in-the-Middle):
// Attacker sends fake ARP replies to both victim and gateway:
// To victim: "10.0.1.1 (gateway) is at ATTACKER_MAC"
// To gateway: "10.0.1.5 (victim) is at ATTACKER_MAC"
// Both update their ARP caches with attacker's MAC
// All traffic now flows through attacker → can read/modify packets
// ARP spoofing mitigations:
// — Dynamic ARP Inspection (DAI) on managed switches: validates ARP against DHCP snooping table
// — Static ARP entries for critical hosts: arp -s 10.0.1.1 00:50:56:c0:00:08
// — 802.1X port authentication: prevents unauthorised devices on the LAN
// — Use encrypted protocols (TLS) so sniffed traffic is useless
// IPv6 replacement — Neighbour Discovery Protocol (NDP):
// Uses ICMPv6 Neighbour Solicitation/Advertisement instead of ARP broadcasts
// More secure: can integrate with SEcure Neighbour Discovery (SEND)Key Points to Remember
- 1ARP resolves IP addresses to MAC addresses on the same LAN segment.
- 2ARP Request is broadcast (FF:FF:FF:FF:FF:FF); ARP Reply is unicast.
- 3ARP cache stores IP→MAC mappings, typically for 20 minutes.
- 4For off-subnet traffic, the host ARPs for the default gateway's MAC, not the final destination.
- 5Gratuitous ARP announces IP-to-MAC changes — used for virtual IP failover.
- 6ARP spoofing poisons caches to redirect traffic through an attacker — mitigated by Dynamic ARP Inspection.
Interview Questions
Sign in to ask AriaWhat is ARP and why is it needed if we already have IP addresses?
What is the difference between an ARP request and an ARP reply?
When you send a packet to a different subnet, whose MAC address do you ARP for?
What is gratuitous ARP and when is it used?
Explain an ARP spoofing attack and how it is mitigated.
Ask Aria about ARP — Address Resolution Protocol
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.