Networking - ARP (Address Resolution Protocol)

What is ARP?

ARP (Address Resolution Protocol) is a protocol used to map an IP address (logical address) to a MAC address (physical hardware address) inside a local area network (LAN).

In other words:

  • Computers communicate using IP addresses.

  • But actual data on an Ethernet/Wi-Fi network travels using MAC addresses.

  • ARP acts like a "translator" between IP and MAC inside a LAN.

Why Do We Need ARP?

  • When one device wants to send data to another in the same LAN, it only knows the target’s IP address.

  • Before sending, it must find the MAC address linked to that IP.

  • ARP provides this mapping.

How ARP Works (Step-by-Step)

  1. Host A wants to send data to Host B (192.168.1.20).

  2. Host A checks its ARP cache (a table of IP ↔ MAC mappings stored locally).

    • If found → it uses the MAC directly.

    • If not found → it broadcasts an ARP Request on the network.

  3. The ARP Request: “Who has IP 192.168.1.20? Tell 192.168.1.10.”

  4. Host B sees the request and replies with its MAC address (ARP Reply).

  5. Host A stores this in its ARP cache for future use.

ARP Message Types

  • ARP Request → Broadcast asking for MAC of a specific IP.

  • ARP Reply → Unicast response containing the MAC address.

ARP Cache

  • Each device keeps an ARP cache to avoid repeating requests.

  • Entries time out after a while (dynamic ARP entries).

Common Uses of ARP

  1. Resolving IP → MAC in local Ethernet or Wi-Fi networks.

  2. Supporting communication between devices inside the same subnet.

Security Issue: ARP Spoofing / Poisoning

  • Attackers can send fake ARP replies to associate their MAC with someone else’s IP (like a gateway).

  • This lets them intercept or redirect traffic (Man-in-the-Middle attack).

  • Defenses: Dynamic ARP Inspection, static ARP entries, secure switches.

 In short: ARP is like asking around in a neighborhood: "Who lives at house number X?" and the right person answers, “That’s me!”

 

Would you like me to also show you an ARP request/reply packet format (fields inside the ARP message), or do you prefer to keep it practical?