11.1 ARP

Introduction

Address Resolution Protocol, or ARP, is a simple but critical protocol that connects two different kinds of addressing on a local network. Devices on an IPv4 network use IP addresses to identify where data should go, but the actual delivery on an Ethernet network uses MAC addresses. ARP is the mechanism that lets a device discover which MAC address corresponds to a given IPv4 address on the same local network.

ARP itself never leaves the local network segment. It is not used to reach devices across routers. For those remote devices, routers and routing are responsible. ARP is only concerned with mapping IPv4 addresses to MAC addresses within a broadcast domain.

The Problem ARP Solves

When a host wants to send an IPv4 packet to another device on the same network, it needs to place that packet inside an Ethernet frame. The Ethernet frame requires a destination MAC address in its header. The host already knows the destination IPv4 address, but it does not necessarily know the destination MAC address. ARP answers the question: “Given this IPv4 address, what is the corresponding MAC address on my local network?”

If the host does not know the MAC address that belongs to a particular IPv4 address, it cannot correctly build the Ethernet frame. ARP provides a way for the host to ask every device on the local network, and for the correct device to reply with its MAC address.

ARP Message Types

ARP uses a simple message structure at the data link layer. The two main message types you will encounter are ARP requests and ARP replies.

An ARP request is a question that a host broadcasts to the local network. It says, in effect, “Who has IPv4 address X.X.X.X? Tell me at MAC address Y.” Every device on the local Ethernet segment receives this broadcast frame, but only the device that owns the target IPv4 address should respond.

An ARP reply is the direct answer to that request. The device that owns the requested IPv4 address sends an ARP reply back to the original requester. This reply contains the mapping of its IPv4 address and MAC address. ARP replies are sent as unicast frames, directly to the requester’s MAC address, not as broadcasts.

ARP Packet Structure

Although ARP messages are usually hidden from everyday users, it is helpful to know what information they carry. An ARP packet rides inside an Ethernet frame and contains fields that describe both the sender and the target at the IPv4 and MAC level.

Common ARP packet fields include the hardware type, which for Ethernet is usually 1, and the protocol type, which for IPv4 is $0x0800$. There are also fields that describe the size of the hardware address and the size of the protocol address. For Ethernet and IPv4 this is usually 6 bytes for the MAC address and 4 bytes for the IPv4 address.

The most important fields in practice are the sender MAC address, sender IPv4 address, target MAC address, and target IPv4 address. In an ARP request the target MAC address is usually all zeros, because the requester does not yet know it. In the ARP reply all of these fields are filled with valid values.

A simplified view of the crucial parts looks like this:

ARP Workflow on a Local Network

When a host decides to send IPv4 traffic to a destination on the same subnet, it follows a sequence that involves ARP if necessary. First it checks whether the destination IPv4 address belongs to the same network as itself. If it is on the same network, the host must learn that device’s MAC address. If it is on a different network, the host must instead send the traffic to a default gateway, and ARP is then used to find the gateway’s MAC address. The details of routing are covered elsewhere, so here we stay with ARP’s part in the process.

If the host’s ARP cache already has an entry for the target IPv4 address, the host can immediately build an Ethernet frame with the known MAC address, place the IPv4 packet inside, and send the frame. If there is no cached entry, the host broadcasts an ARP request on the local network, setting the Ethernet destination MAC address to the broadcast address FF:FF:FF:FF:FF:FF.

Every device on the local Ethernet segment receives this ARP request. Each one compares the target IPv4 address in the ARP packet to its own IPv4 address. If it does not match, the device drops the packet. If it matches, that device prepares an ARP reply that includes its own MAC address and IPv4 address, and sends it as a unicast frame back to the host that made the request.

When the original host receives this ARP reply, it learns the MAC address belonging to the target IPv4 address. It stores this mapping in the ARP cache and then immediately uses that MAC address as the destination MAC in the Ethernet frame for the original IPv4 packet it wants to send.

ARP Caches

Constantly sending ARP broadcasts for every packet would create unnecessary traffic on the local network, so hosts maintain a small local table called an ARP cache. The ARP cache remembers recently learned mappings between IPv4 addresses and MAC addresses. When a host needs a MAC address for a given IPv4 address, it checks this cache first.

An ARP cache entry typically includes the IPv4 address, the corresponding MAC address, and a type such as dynamic or static. Dynamic entries are learned automatically from ARP traffic. They have a limited lifetime and expire after a period of inactivity. Static entries are manually configured and do not expire automatically.

A simplified ARP cache might look like this:

When an entry expires, the next packet that needs that mapping will trigger a new ARP request. Some systems also refresh entries by sending ARP queries before removing them from the cache.

ARP and Broadcast Domains

ARP relies on broadcast at the data link layer. ARP requests are sent to the Ethernet broadcast MAC address, which every device in the same broadcast domain receives. Devices outside that broadcast domain, such as those on other VLANs or subnets across a router, do not see those broadcasts.

Each router interface that connects to a different network has its own ARP behavior. A router maintains a separate ARP cache for each of its interfaces, because each interface is part of a different broadcast domain. When a host wants to reach a remote network, it uses the router as a next hop, and the host will use ARP to resolve the router’s interface IPv4 address on its own local network to the router’s MAC address. The router then handles forwarding the packet on to the next network segment.

ARP Variants and Related Concepts

There are some behaviors related to ARP that extend the basic request and reply model. One common behavior is the use of ARP to help detect IPv4 address conflicts. A device that is about to use a certain IPv4 address may send an ARP message that effectively asks whether anyone already uses this IPv4 address. If another device responds, that shows a conflict.

Another important behavior occurs when a device updates other devices about its own mapping without being asked. This is covered in more detail in the related topic on gratuitous ARP, but at a high level it is a way for a host to announce or refresh its own IPv4 and MAC mapping to the local network, without any prior ARP request.

There are also special ARP uses in virtualized and clustered environments. For example, if two devices share a virtual IPv4 address for high availability, ARP traffic helps update other hosts so that they send traffic to the currently active device. The details of high availability and redundancy are covered in separate chapters, but ARP is one of the tools that make these designs function correctly at the local network level.

ARP in Troubleshooting

Because ARP is the link between IPv4 addresses and MAC addresses on a local network, it is a frequent focus during troubleshooting. If a host can reach some devices on the network but not others that should be reachable, checking the ARP cache can reveal missing or incorrect entries. An entry with the wrong MAC address for a particular IPv4 address can cause traffic for that address to be sent to the wrong device, which results in connection failures.

Network analyzers like packet capture tools can show ARP traffic on the wire. A healthy network typically has ARP requests only when needed, and matching replies that supply the correct MAC address. An unusually high rate of ARP requests can indicate a misconfiguration or a device that repeatedly loses its ARP cache. A lack of ARP replies can show that the target device is offline, misconfigured, or blocked.

To verify ARP behavior, administrators often clear the ARP cache on a host and then attempt a connection again while capturing packets. This lets them see the exact ARP exchanges that occur and whether the correct mappings are learned.

ARP and Security Concerns

ARP was designed for simplicity and has no built in security checks. Devices generally trust ARP replies without verifying them. This creates a risk where a malicious device can send forged ARP messages that associate its own MAC address with another device’s IPv4 address. This is known as ARP spoofing or ARP poisoning and can allow traffic to be redirected through the attacker.

Because of this behavior, many switches and security devices provide features to control ARP responses, such as binding IPv4 addresses and MAC addresses in a secure table or limiting who can send ARP replies for certain addresses. The details of those protections belong in security focused sections, but it is important at this stage to recognize that ARP’s trust based design is both a strength in simplicity and a weakness in terms of security.

Summary

ARP provides the essential link between IPv4 addressing and Ethernet MAC addressing on a local network. It uses simple broadcast requests and unicast replies to allow hosts to learn which MAC address corresponds to a particular IPv4 address. The ARP cache stores these mappings temporarily so that hosts do not need to constantly query the network.

ARP operates only inside a broadcast domain, and each network segment has its own ARP activity and caches. This protocol is deeply involved in normal network operation, in troubleshooting tasks, and unfortunately also in certain security attacks. Understanding ARP gives you a clearer picture of how IPv4 packets are actually delivered over Ethernet on your local network.