What is ARP?
IP addresses get a packet to the right network, but on an Ethernet or Wi-Fi segment each frame must be addressed to a MAC address. ARP bridges that gap for IPv4. Before a host sends a frame on its local network, it needs the MAC address of the next hop; ARP looks it up and caches the answer.
How ARP works
- The host uses its own IP address and subnet mask to decide whether the destination is on the same subnet.
- If the destination is local, the next hop is the destination itself. If it is remote, the next hop is the default gateway.
- The host checks its ARP cache for the next hop's IP address.
- On a miss, it broadcasts an ARP request to FF-FF-FF-FF-FF-FF that amounts to "Who has 192.168.1.1? Tell 192.168.1.25."
- The device that owns that address sends a unicast ARP reply containing its MAC address.
- The host stores the mapping in its cache and sends the frame.
A PC sending traffic to a web server on the internet never learns that server's MAC address. It only resolves its default gateway, and each router along the path repeats the process for its own next hop.
ARP commands
| Command | What it does |
|---|---|
arp -a | Shows the ARP cache (Windows, macOS and Linux) |
arp -d * | Clears the cache on Windows (run as administrator) |
arp -s | Adds a static entry that does not age out |
ip neigh | Shows the neighbor (ARP) table on modern Linux |
Windows marks each entry as dynamic or static. Dynamic entries age out after a short time, so the cache only holds devices the host has talked to recently.
Gratuitous ARP and duplicate addresses
A gratuitous ARP is a message a host sends about its own IP address. Hosts send one when they come online or change addresses, and failover devices use it to update their neighbors' caches. If another device answers for the same IP address, the operating system knows the address is a duplicate, which is how Windows detects an IP address conflict.
ARP spoofing
ARP has no authentication, and hosts accept replies they never asked for. In an ARP spoofing (ARP poisoning) attack, a device on the LAN sends forged replies claiming that the gateway's IP address belongs to the attacker's MAC address. Victims then send their traffic through the attacker, which sets up an on-path (man-in-the-middle) attack. Warning signs in arp -a include the gateway's IP address showing the same MAC address as another host on the LAN, or the gateway's MAC address changing unexpectedly. Defenses include dynamic ARP inspection on managed switches, static entries for critical hosts, port security, and encrypted protocols such as HTTPS and VPNs that limit what an on-path attacker can read.
ARP vs. related lookups
- ARP: IPv4 address to MAC address.
- DNS: host name to IP address.
- Switch MAC address table: MAC address to switch port.
- NDP: IPv6 does not use ARP. It uses Neighbor Discovery Protocol, whose ICMPv6 neighbor solicitation and advertisement messages go to multicast addresses instead of a broadcast.
ARP on the CompTIA A+ exam
ARP is not a named bullet in the Core 1 objectives, but it sits under several that are: the MAC address of a network interface card (objective 2.5), the default gateway in SOHO addressing (objective 2.6), and network troubleshooting. Know that ARP resolves IPv4 addresses to MAC addresses on the local segment, that the request is a broadcast and the reply is unicast, that traffic to a remote host resolves the gateway's MAC address, and that arp -a displays the cache. ARP poisoning is one way to carry out an on-path attack, a Core 2 security topic. If a question asks which protocol maps an IP address to a hardware address, think ARP.