Quick Summary
- ARP maps IP addresses to MAC addresses on a local network segment
- It uses a broadcast request ("Who has this IP?") and a unicast reply ("I do, here is my MAC")
- Results are cached in the ARP table to avoid repeating the process for every packet
Why ARP Exists
When your computer wants to send data to another device on the same local network, it knows the destination's IP address -- but IP addresses are a Layer 3 concept. Ethernet frames, which actually carry data across the wire, require a Layer 2 MAC address to deliver the frame to the correct network interface card. The problem is simple: your computer has the IP address but needs the MAC address. ARP (Address Resolution Protocol) bridges this gap.
Think of it like knowing someone's apartment number but not their unit buzzer code. You need some way to look up the buzzer code before you can reach them. ARP is that lookup mechanism for Ethernet networks. It is defined in RFC 826 and has been a fundamental part of IPv4 networking since 1982. Every device on an IPv4 network uses ARP constantly, usually without the user ever knowing it.
ARP only works within a single broadcast domain -- it cannot cross routers. If the destination IP is on a different subnet, your computer uses ARP to find the gateway router's MAC address instead, and the router handles forwarding from there. This is a critical distinction that trips up many networking beginners.
Interactive: Step-Through ARP Handshake
Click each step button to walk through a complete ARP exchange between two computers. Watch the broadcast go out, the reply come back, and the ARP cache update.
ARP Handshake Walkthrough
PC-A's ARP Cache
| IP Address | MAC Address | Type |
|---|---|---|
| ARP cache empty -- no entries yet | ||
The ARP Process in Detail
Check the ARP Cache
Before sending an ARP request, the device checks its local ARP cache (also called the ARP table). This is a list of recently resolved IP-to-MAC mappings stored in memory. If the destination IP is already in the cache, the device uses the cached MAC address immediately and skips the ARP process entirely. Cached entries have a timeout (typically 20-60 seconds depending on the OS) after which they expire and must be re-resolved.
Send ARP Request (Broadcast)
If the IP is not in the cache, the device constructs an ARP request packet. This packet contains the sender's IP and MAC address, the target IP address, and a destination MAC of FF:FF:FF:FF:FF:FF (broadcast). The switch floods this frame to every port. Every device on the LAN receives the request, but only the device with the matching IP address will respond. All other devices silently discard the request.
Receive ARP Reply (Unicast)
The target device recognizes its own IP in the ARP request and sends back an ARP reply. Unlike the request, the reply is unicast -- it is addressed directly to the MAC address of the device that asked. The reply contains the target's MAC address, which is exactly what the sender needed. The sender receives this reply, extracts the MAC address, and can now construct an Ethernet frame to send data to the target.
Update the ARP Cache
After receiving the reply, the sender adds a new entry to its ARP cache: "IP 192.168.1.20 is at MAC BB:BB:BB:BB:BB:BB." Future packets to the same IP will use this cached entry without triggering another ARP exchange. The target device also updates its own cache with the sender's IP-to-MAC mapping (since that information was included in the ARP request), which optimizes bidirectional communication.
ARP and Routing
A common question from beginners is: "If I ping a server on the internet, does my computer ARP for that server's MAC address?" The answer is no. ARP only works within the local broadcast domain. When your computer detects that the destination IP is on a different subnet (by comparing it against its own IP and subnet mask), it instead uses ARP to resolve the MAC address of its default gateway -- the router. Your computer sends the IP packet inside an Ethernet frame addressed to the router's MAC. The router then strips the Ethernet header, looks at the IP destination, and forwards the packet out the appropriate interface, potentially through many more routers, until it reaches the destination network.
At each hop, ARP is used again. Router A uses ARP to find Router B's MAC address, Router B uses ARP to find Router C's MAC address, and so on. The IP addresses in the packet never change (source and destination stay the same), but the MAC addresses in the Ethernet frame change at every hop. This is one of the most important concepts in networking: IP addresses are end-to-end, MAC addresses are hop-by-hop.
Gratuitous ARP
A gratuitous ARP is an ARP request or reply where the sender and target IP addresses are the same. The device is essentially announcing: "This IP address is at this MAC address." Gratuitous ARPs serve several purposes: they update other devices' ARP caches after a MAC address change (for example, during failover in a high-availability cluster), they detect IP address conflicts (if another device responds to a gratuitous ARP, both devices have the same IP), and they help switches update their MAC address tables after a virtual machine migration.
ARP Security Concerns
ARP Spoofing
ARP has no authentication. Any device can claim to be any IP by sending forged ARP replies. An attacker can redirect traffic through their machine (man-in-the-middle) by poisoning victims' ARP caches. This is one of the oldest and most effective LAN attacks.
ARP Cache Poisoning
By continuously sending fake ARP replies, an attacker can keep a victim's ARP cache polluted with wrong entries. The victim's traffic flows to the attacker instead of the real destination. Defenses include Dynamic ARP Inspection (DAI) on managed switches.
ARP Storms
In poorly designed networks, excessive ARP broadcasts can consume significant bandwidth. Large flat networks (without VLAN segmentation) with hundreds of devices generate constant ARP traffic as caches expire and are refreshed.
ARP vs. NDP (IPv6)
IPv6 does not use ARP at all. Instead, it uses Neighbor Discovery Protocol (NDP), which is built on top of ICMPv6. NDP performs the same IP-to-MAC resolution function as ARP, but it uses multicast instead of broadcast, can be protected with SEND (Secure Neighbor Discovery), and handles additional tasks like router discovery, prefix advertisement, and duplicate address detection. SEND is rarely deployed, though, so plain NDP can be spoofed much like ARP; switch features such as RA Guard fill that gap in practice.
Frequently asked questions about ARP
What does ARP stand for?
ARP stands for Address Resolution Protocol. It is the Layer 2 protocol that maps an IPv4 address to the MAC (hardware) address of a device on the same local network, so the sender knows which physical interface to deliver a frame to.
How does ARP work?
When a host needs to talk to an IP on its local subnet but does not yet know the MAC, it broadcasts an ARP request asking "who has 10.0.0.5?". The host that owns that IP replies with its MAC address. The asker caches the mapping and uses it for subsequent frames.
What is the ARP cache?
The ARP cache is a short-lived table on every host that maps IP addresses to MAC addresses learned from ARP replies. Entries usually expire after a few minutes so that the network can adapt to NIC changes or device moves.
What is ARP spoofing?
ARP spoofing (or ARP poisoning) is an attack where a malicious host sends forged ARP replies to associate its own MAC with someone else's IP — typically the default gateway. Victims then send their traffic to the attacker, enabling man-in-the-middle interception.
Does IPv6 use ARP?
No. IPv6 replaces ARP with Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages instead of broadcasts. The underlying problem is the same — map a network address to a link-layer address — but the mechanism is different.
Try ARP yourself
You just learned how ARP discovers MAC addresses on a LAN. Now trace a ping between two hosts on a switch, check the MAC addresses in the Packet Inspector, and read the ARP table with arp. Press Go Live to run the same ping between real Linux hosts and see the entry appear in their ARP cache.