Address Resolution Protocol (ARP)
Scenario
You know your coworker's name (IP address) and want to hand them a document, but you're standing in a massive, crowded open-plan office. You shout, 'Who here is John Smith?' John hears his name and shouts back, 'I am over here at desk 4B (MAC address)!' That shout is ARP.
Mental model
ARP bridges the gap between software and hardware by translating logical IP addresses into physical MAC addresses.
When a computer needs to send data locally, it knows the target's IP address but needs the hardware MAC address to actually build the physical frame. It broadcasts an 'ARP Request' to everyone asking 'Who has this IP?'. The target replies with an 'ARP Reply' containing its MAC address.
Explanation
In computer networking, IP addresses (Layer 3) are used to route data across the global internet, while MAC addresses (Layer 2) are used to deliver data between physical hardware on a local network. When an application wants to send a packet to another computer on the same local network, it only knows the destination's IP address. However, the network card cannot transmit the packet without wrapping it in an Ethernet frame, which requires a destination MAC address.
The Address Resolution Protocol (ARP) is the glue that connects these two layers. It provides a dynamic mapping from a 32-bit IPv4 address to a 48-bit MAC address. When a computer needs this mapping, it first checks its local 'ARP Cache', a temporary table stored in RAM that remembers recent IP-to-MAC translations.
If the IP address is not found in the cache, the computer initiates an ARP Request. It creates a special packet containing the target IP address and sends it to the Ethernet broadcast MAC address (FF:FF:FF:FF:FF:FF). Because it's a broadcast, the network switch forwards this frame out of every port. Every single computer on the local network receives and processes this request.
When the other computers receive the ARP Request, they check the target IP address against their own. The computers that do not match simply discard the packet. The one computer that does have the matching IP address generates an ARP Reply. This reply contains its own MAC address and is sent directly back to the original requester (unicast, not broadcast).
Upon receiving the ARP Reply, the original computer updates its ARP Cache with the new mapping. It can now construct the Ethernet frame with the correct destination MAC address and finally transmit the actual data payload. Because ARP relies on trusting these broadcasts without verification, it is vulnerable to 'ARP Spoofing', where a malicious attacker floods the network with fake ARP replies to intercept traffic.
Key points
- ARP Cache: A temporary local table on each device that maps recently resolved IP addresses to MAC addresses to reduce broadcast traffic.
- ARP Request: A broadcast frame sent to all devices on the local network asking 'Who has this IP address?'
- ARP Reply: A unicast frame sent directly back to the requester containing the requested MAC address.
- ARP Spoofing: A security vulnerability where an attacker sends fake ARP replies to associate their own MAC address with another device's IP (like the router), enabling a Man-in-the-Middle attack.
Common mistakes
- ARP routes traffic across the internet: ARP only operates within a single local network boundary (a broadcast domain). It cannot cross routers. When sending data to the internet, ARP is only used to find the local router's MAC address.
- ARP works with IPv6: ARP is strictly for IPv4. IPv6 uses a completely different protocol called Neighbor Discovery Protocol (NDP), which utilizes ICMPv6 and multicast instead of broadcast.
Glossary
- ARP Request
- A broadcast message sent over a local network asking Which device has this IP address? to discover the corresponding hardware MAC address.
- ARP Reply
- A direct response to an ARP Request containing the specific hardware MAC address that matches the requested IP address.
- ARP Cache
- A temporary local memory table on a device that stores recently learned pairs of IP addresses and MAC addresses to speed up future communication.
Recall questions
- What is the primary purpose of ARP?
- Is an ARP Request sent as a unicast or broadcast packet?
- What is an ARP Cache?
Questions & answers
A host wants to send a packet to an IP address on a different subnet. Which MAC address will the host ask for via ARP?
The MAC address of its Default Gateway (the router).
Approach: Realize that ARP broadcasts cannot cross subnets. To send traffic outside the local network, the host must first send the frame locally to the router, so it ARPs for the router's IP.
How does an ARP Spoofing attack achieve a Man-in-the-Middle position?
By flooding the network with unsolicited ARP Replies, tricking devices into updating their ARP cache with the attacker's MAC address instead of the legitimate router or host.
Approach: Explain that ARP is stateless and trusts incoming replies without verification, allowing an attacker to silently rewrite the mapping tables of victim machines.
Continue learning
Previous: MAC, Ethernet & CSMA/CD