ARP
Resolve IPv4 to MAC on a LAN. The cache, the timeout, and the spoof.
Level: intermediate
What is it?
Address Resolution Protocol (ARP) discovers the layer-2 MAC address associated with an IPv4 address on the local link. A host broadcasts a request asking which device owns an IP address; the owner typically replies with its MAC address.
Why does it matter?
IP routing needs a frame for the next local hop. When the destination is off-subnet, ARP resolves the gateway's MAC address rather than resolving the remote server's MAC directly.
Mental model
IP chooses where a packet should go at the network layer; ARP finds the local Ethernet envelope recipient for the next hop. The answer is normally cached briefly to avoid broadcasting for every packet.
How it works
- ARP is for IPv4 on a local broadcast domain; IPv6 uses Neighbor Discovery.
- An ARP request is normally broadcast, while the response is usually unicast to the requester.
- ARP cache entries can be stale and refreshed; static and dynamic entries have different management properties.
- ARP is not authenticated by default, which enables spoofing on a local network without additional protections.
- ARP does not cross routers as a normal broadcast; each routed hop resolves its own next-hop address.
Steps
- A host wants to send to a remote IPv4 destination.
- It checks the routing table and chooses the default gateway as next hop.
- If the gateway MAC is not in the ARP cache, the host broadcasts an ARP request for the gateway's IP.
- The gateway replies with its MAC; the host sends an Ethernet frame to that MAC with the remote IP packet as payload.
Real-world usage
- Debugging a same-subnet host that cannot be reached.
- Understanding gateway MAC resolution and ARP caches.
- Assessing local-network spoofing risks and mitigations.
Common mistakes
- Trying to ARP for a remote internet server instead of the local gateway.
- Assuming an ARP reply is cryptographically authenticated.
- Confusing ARP cache problems with DNS resolution failures.
Interview questions
If a server is on another subnet, whose MAC does the host resolve?
The host normally resolves the next-hop router/default gateway's MAC, while the IP destination remains the remote server.
Why is ARP spoofing possible?
Basic ARP replies are not authenticated cryptographically, so a local attacker may send false IP-to-MAC mappings unless protections detect or prevent it.