What Is ARP? Address Resolution Protocol Explained

Why ARP Exists

Your computer communicates using two types of addresses:

• [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) (Layer 3) — logical, used for [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) across networks (e.g., 192.168.1.50)
• MAC address (Layer 2) — physical, burned into the network card (e.g., 00:1A:2B:3C:4D:5E)

When your computer wants to send data to another device on the same local network, it knows the destination [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) but needs its MAC address to actually deliver the Ethernet frame. ARP (Address Resolution protocol) solves this: it discovers the MAC address that corresponds to a known IP address.

How ARP Works: Step by Step

Suppose your computer (192.168.1.10) wants to send data to a printer (192.168.1.20):

1. ARP Request (broadcast): Your computer shouts to every device on the network:

> "Who has IP 192.168.1.20? Tell 192.168.1.10."

1. ARP Reply (unicast): The printer responds directly to your computer:

> "192.168.1.20 is at MAC address 00:50:56:AB:CD:EF."

1. Caching: Your computer stores this mapping in its ARP cache (ARP table) so it does not have to broadcast the same question repeatedly.

$ arp -a
Interface: 192.168.1.10
  Internet Address    Physical Address       Type
  192.168.1.1         00-14-22-01-23-45      dynamic
  192.168.1.20        00-50-56-ab-cd-ef      dynamic
  192.168.1.255       ff-ff-ff-ff-ff-ff      static

The ARP Cache

The ARP cache is a temporary table your operating system maintains:

• Dynamic entries: Learned via ARP replies, expire after a few minutes
• Static entries: Manually configured, persist across reboots
• Broadcast entry: 255.255.255.255 always maps to FF:FF:FF:FF:FF:FF

Cache entries expire to handle changes — if a device gets a new network card (new MAC), the old cache entry would be wrong. Expiry forces a fresh ARP request.

The Network Switch and MAC Address Tables

A network [switch-virtual-local-area-network-explained)](/learning-center/what-is-a-vlan-virtual-local-area-network-explained) also maintains its own table called a MAC address table (or CAM table), mapping MAC addresses to the physical port-the-internets-core-protocol)-and-UDP-ports-explained) each device is plugged into. This allows switches to send frames only to the correct port rather than flooding all ports.

ARP and MAC tables work together:

1. ARP tells your PC the destination MAC address
2. The switch-virtual-local-area-network-explained) uses its MAC address table to deliver the frame to the right port-the-internets-core-protocol)-and-UDP-ports-explained)

What Is Gratuitous ARP?

A gratuitous ARP is an unsolicited ARP reply — a device announces its own IP-to-MAC mapping to the network without anyone asking. Legitimate uses:

• Notifying the network after a network card is replaced (new MAC)
• Updating caches after IP reassignment
• High-availability failover: a standby server announces it has taken over a virtual IP

Gratuitous ARP is also how ARP poisoning works, as it can overwrite existing cache entries.

ARP Poisoning (ARP Spoofing)

ARP has no authentication. Any device on the network can send a forged ARP reply claiming any IP-to-MAC mapping. Attackers exploit this in ARP poisoning:

How an ARP Poisoning Attack Works

1. Alice (192.168.1.10) and Bob (192.168.1.20) are communicating
2. Attacker (192.168.1.99) sends forged ARP replies to both:

• To Alice: "192.168.1.20 is at the attacker's MAC address"
• To Bob: "192.168.1.10 is at the attacker's MAC address"

1. Both Alice and Bob update their ARP caches with the attacker's MAC
2. Traffic flows: Alice → Attacker → Bob, and Bob → Attacker → Alice
3. The attacker is now performing a man-in-the-middle (MITM) attack

Defending Against ARP Poisoning

| Defence | How it helps | |---|---| | Dynamic ARP Inspection (DAI) | switch-virtual-local-area-network-explained) validates ARP packets against a [DHCP snooping](/learning-center/what-is-dhcp-dynamic-host-configuration-protocol-explained) table | | Static ARP entries | Manually configure critical mappings (impractical at scale) | | VPN / TLS | Even if traffic is intercepted, it is encrypted and integrity-protected | | network monitoring-intrusion-detection-and-prevention-explained)-and-ips-intrusion-detection-and-prevention-explained) | Tools like XArp or Wireshark detect duplicate IP-to-MAC entries | | VLAN segmentation | Limits ARP broadcast domain-kerberos-directory-services-explained); an attacker in one VLAN cannot poison another |

ARP vs NDP (IPv6)

IPv6-address-ipv4-ipv6-and-addressing-explained) does not use ARP. It uses Neighbor Discovery protocol (NDP) instead, which is part of ICMPv6. NDP is more secure and includes protections against some spoofing attacks.

| protocol | Layer | Purpose | |---|---|---| | ARP | Layer 2/3 | IP to MAC (IPv4-and-addressing-explained)) | | RARP | Layer 2/3 | MAC to IP (obsolete, replaced by DHCP) | | NDP | ICMPv6 | IPv6-address-ipv4-ipv6-and-addressing-explained) equivalent of ARP |

Practical ARP Commands

# View ARP cache (Linux/Mac)
arp -n

# View ARP cache (Windows)
arp -a

# Delete a specific entry (Linux)
sudo arp -d 192.168.1.20

# Add a static entry (Linux)
sudo arp -s 192.168.1.20 00:50:56:AB:CD:EF

# Watch ARP traffic in Wireshark
# Filter: arp

Summary

• ARP resolves IP addresses to MAC addresses on local networks
• It works via broadcast requests and unicast replies, with results cached locally
• ARP has no built-in authentication, making it vulnerable to poisoning and spoofing attacks
• ARP poisoning enables man-in-the-middle attacks by poisoning both parties' caches
• Defences include Dynamic ARP Inspection on managed switches and network-level encryption
• IPv6-address-ipv4-ipv6-and-addressing-explained) replaces ARP with the more secure Neighbor Discovery protocol (NDP)