Skip to main content
protocols.pageprotocols.page
networking

ARP (Address Resolution Protocol)

ARP resolves IP addresses to MAC addresses on local networks. When a host needs to send a packet to an IP on the same subnet, it broadcasts an ARP request. The target responds with its MAC address. ARP has no authentication – ARP spoofing enables man-in-the-middle attacks on LANs.

Definition

Address Resolution Protocol maps Layer 3 (IP) addresses to Layer 2 (MAC) addresses. When host A wants to send to 192.168.1.5 on the local subnet, it broadcasts 'Who has 192.168.1.5?' (ARP Request) to FF:FF:FF:FF:FF:FF. The host with that IP responds with its MAC address (ARP Reply). The result is cached in the ARP table (typically 60-300 seconds). ARP operates only within a broadcast domain – routers do not forward ARP. For destinations on other subnets, the host ARPs for the default gateway's MAC instead. ARP spoofing (gratuitous ARP with a false MAC) allows an attacker to intercept traffic on the LAN by making other hosts send packets to the attacker's MAC. Dynamic ARP Inspection (DAI) on managed switches validates ARP packets against the DHCP snooping database to prevent this.

Examples

  • –arp -a shows the local ARP cache
  • –arping -I eth0 192.168.1.1 sends ARP requests
  • –arpwatch monitors ARP changes and alerts on new/changed MAC-IP pairs

Related Protocols

ip

Related Terms

Frame

A frame is a Layer 2 (data link) unit of data that includes a header with MAC addresses, the payload (an IP packet), and a trailer with error-checking CRC. Ethernet frames have a maximum size of 1518 bytes. Frames are addressed by MAC, not IP – they do not cross router boundaries.

NAT (Network Address Translation)

NAT translates private IP addresses to public IP addresses at a router boundary. NAT allows many devices to share one public IP. It breaks end-to-end connectivity – inbound connections require port forwarding. Carrier-grade NAT (CGNAT) adds another translation layer, complicating VoIP and gaming.

VLAN (Virtual LAN)

A VLAN segments a physical switch into multiple isolated broadcast domains using 802.1Q tags. Devices in different VLANs cannot communicate without a router (inter-VLAN routing). VLANs provide security isolation, reduce broadcast traffic, and enable network segmentation without separate physical infrastructure.