Address Resolution Protocol (ARP)

Two Addresses in Local Delivery: The Role of ARP

To send data over the internet, a computer needs a destination IP address. This is the logical address used by routers to select a path across networks, for example from Los Angeles to New York. When the packet reaches its destination local network, the IP header alone does not provide the link-layer address required for the next frame.

An IP address identifies a host at the internet layer, while an Ethernet or Wi-Fi frame requires a data-link address. A router can forward the packet between networks, but every local hop still needs a destination MAC address for the frame. ARP supplies the mapping used for this local delivery.

In a local network, an interface can use a 48-bit MAC address. For a device to send data to another device on the same local network, it must know the recipient's MAC address. The practical question is: "I want to send this packet to $192.168.1.100$; which MAC address belongs in the frame?"

The Address Resolution Protocol (ARP) determines the MAC address associated with a known IPv4 address on the local segment. The result can be stored in a cache and reused for subsequent frames. An ARP message includes the hardware type, protocol type, address lengths, operation code, and sender and target addresses. A request normally leaves the target hardware address unknown, while the reply fills it in. The format can describe more than one link technology, although Ethernet is its most common use.

The ARP Process: "Who has this IP? Tell me!"

The ARP process consists of a request and a reply. When a source device (Host A) needs to send a packet to a destination device (Host B) on the same segment, it first checks its stored mapping and then follows these steps:

Step 1: Check the ARP Cache

Before doing anything else, Host A checks its local ARP cache. This is a small, temporary table in memory that stores recently resolved IP-to-MAC address mappings. If Host A has recently communicated with Host B, the mapping will likely still be in the cache, and the process can skip directly to sending the data.

Step 2: The ARP Request (Broadcast)

If the mapping for Host B's IP address is not found in the cache, Host A constructs a special message called an ARP Request. The request includes the target IPv4 address and the sender information needed to prepare a reply.

This message is a broadcast message. On ordinary Ethernet it is sent to the special MAC address FF:FF:FF:FF:FF:FF, which devices on that segment receive. The ARP Request contains the target IPv4 address and the sender's MAC address:

"Who has the IP address 192.168.1.100? Please tell the device with MAC address AA:BB:CC:11:22:33 (my own MAC address)."

Every device on the local network receives and processes this broadcast request.

Hosts inspect the target protocol address, for example $192.168.1.100$, and can ignore requests for other addresses. The sender address gives the reply a return destination, while the cache records the IPv4-to-MAC association on a particular interface.

Step 3: The ARP Reply (Unicast)

In the ordinary host case, the device whose IPv4 address appears in the target field responds. Other hosts do not use the request as their own mapping. A device configured for Proxy ARP may reply on behalf of a host reachable through another interface.

Host B, recognizing its IP $192.168.1.100$, will create an ARP Reply. This reply is a unicast message, usually sent directly to Host A's MAC address from the request. The reply supplies the MAC address associated with the requested IPv4 address:

"I am the device with IP address $192.168.1.100$, and my MAC address is DD:EE:FF:44:55:66."

Step 4: Update Cache and Send Data

Host A receives the ARP Reply and obtains the mapping $192.168.1.100$ = DD:EE:FF:44:55:66. It adds the mapping to its ARP cache according to the implementation's rules. Host A can now create a frame with the correct destination MAC address and send it to Host B on the segment.

The ARP Cache and Entry Updates

Sending a broadcast ARP Request for every packet would add unnecessary frames to the segment. The ARP cache stores learned mappings and lets the host reuse them for a period defined by the implementation.

• Function: The cache stores a dynamic list of recently learned IP-to-MAC address mappings. Some systems also support manually configured static entries for selected hosts, such as a gateway.
• Entry aging: Cache entries are not permanent. An implementation may expire them, refresh them after reachability checks, or replace them when information changes. The exact timers and states depend on the operating system. After a mapping is removed, the next communication triggers a new ARP request.
• Viewing the Cache: You can view your computer's ARP cache by opening a command prompt or terminal and typing the command arp -a. This will display a list of known IP addresses and their corresponding MAC addresses on your local network.

ARP's Scope: The Local Network Boundary

ARP works within a single local network segment (or broadcast domain). A request is link-local, and an ordinary IPv4 router does not forward it to another interface. Proxy ARP is an explicit exception in which a router answers selected requests and then forwards the packet.

So, how do we send data to a different network?

For a destination outside the subnet, the host uses its default gateway. The local frame carries the router's MAC address, while the packet's destination IP remains the remote server's address. The router receives the frame and selects the next segment of the route.

When your computer (Host A) wants to send a packet to a remote destination (like a web server on the internet), it follows these steps. The ARP exchange resolves the gateway's local MAC, not the remote server's MAC, for a remote destination.

1. Destination Check: The computer compares the destination IP address with its own IP address and subnet mask. It quickly determines that the destination is on a remote network.
2. Target the Gateway: The destination is remote, so the computer knows it cannot deliver the packet directly. It must send it to its configured default gateway (the local router).
3. ARP for the Gateway: Now, the computer initiates the ARP process, but with a different goal. It sends out an ARP Request broadcast asking:

   "Who has the IP address of my default gateway ($192.168.1.1$)? Please tell me your MAC address."

4. Send to Gateway: Once the router replies with its MAC address, the computer creates the data packet. The packet's destination IP address is still the final remote server, but the destination MAC address is that of the local router. The packet is then sent to the router, which takes over the task of forwarding it toward its final destination.

Variations of ARP

Besides the standard request and reply, ARP has historical variants and uses related to proxying, conflict detection, and cache updates.

• Reverse ARP (RARP):A historical protocol used by diskless workstations. A device would know its MAC address but not its IP address. It would broadcast a RARP request ("My MAC is X, what is my IP?"), and a RARP server on the network would reply with an assigned IP address. RARP is now obsolete and has been replaced by more advanced protocols like BOOTP and, most commonly, DHCP.
• Proxy ARP: A router responds on one network to ARP requests for IPv4 addresses reachable through another interface. It supplies its own MAC address and forwards the packet to the actual destination after receiving the frame. This can connect segments without changing host addressing, while increasing configuration dependencies and making the path harder to analyze.
• Gratuitous ARP: This is an ARP message sent without a preceding request. A host can announce its own IPv4-to-MAC mapping so neighboring devices refresh their caches. For conflict detection, the standard procedure uses an ARP Probe with sender IP 0.0.0.0 to test a tentative address.
  • IP Conflict Detection: A reply to an ARP Probe or another indication that the tentative address is in use signals a conflict. A single address announcement does not replace the duplicate-address detection procedure.
  • Updating Caches: After an interface change or an address takeover, a host can announce the new mapping. Neighboring devices may update their caches, which is useful in high-availability systems.

ARP and Network Security

ARP does not authenticate replies, so it is vulnerable to ARP Spoofing and ARP Poisoning. A host may accept a forged mapping and direct frames to an unauthorized device.

An attacker can send replies that associate its MAC address with the host or the default gateway. Some traffic may then pass through the attacker's machine, enabling interception, modification, or blocking in a Man-in-the-Middle (MitM) attack. Common mitigations include static bindings, port protection, DHCP Snooping with Dynamic ARP Inspection, and network segmentation.

ARP and IPv6

IPv6 does not use ARP. Neighbor address resolution and related configuration functions are provided by the Neighbor Discovery Protocol (NDP), a set of ICMPv6 messages.

NDP uses messages such as Neighbor Solicitation and Neighbor Advertisement with multicast addressing, and also supports router discovery, prefix discovery, and neighbor reachability. Multicast listener membership is handled by the separate MLD mechanism, which also uses ICMPv6. Together these functions replace ARP's local role in IPv6.