ARP (Address Resolution Protocol): Bridging IPv4 and MAC Addresses
ARP (Address Resolution Protocol) is a critical networking protocol that enables communication in IPv4 Ethernet networks by linking logical IP addresses to physical MAC addresses. Operating at the intersection of the OSI model's Layer 2 (Data Link) and Layer 3 (Network), ARP ensures seamless packet delivery within local networks. However, its lack of encryption and authentication introduces security risks like ARP spoofing and cache poisoning.
How ARP Works
The Resolution Process
ARP dynamically maps IPv4 addresses to MAC addresses through a request-reply mechanism:
- A device checks its ARP cache for an existing IP-to-MAC mapping.
- If no entry exists, it broadcasts an ARP request (e.g.,
Who has 192.168.1.1?). - The target device responds with a unicast ARP reply (e.g.,
192.168.1.1 is at BB:BB:BB:BB:BB:BB). - The sender updates its ARP cache and transmits the frame.
Note: ARP is not used in IPv6. IPv6 relies on Neighbor Discovery Protocol (NDP) instead.
Role in the OSI Model
ARP bridges Layer 2 and Layer 3:
- Layer 3 (Network): Uses IP addresses for logical addressing and routing.
- Layer 2 (Data Link): Uses MAC addresses for physical addressing and frame delivery.
- ARP resolves the Layer 3 IP address to a Layer 2 MAC address before transmission.
Core Components
ARP Cache
A temporary table on each device that stores IP-to-MAC mappings:
- Dynamic entries: Added/removed automatically based on network activity.
- Expiration: Entries typically expire after 2–20 minutes (configurable).
- Purpose: Reduces network traffic by avoiding repeated ARP requests.
Example ARP Cache Entry:
| IP Address | MAC Address | Type | State |
|---|---|---|---|
| 192.168.1.1 | BB:BB:BB:BB:BB:BB | Dynamic | Valid |
| 192.168.1.20 | CC:CC:CC:CC:CC:CC | Dynamic | Valid |
Packet Headers
ARP relies on specific fields in IPv4 and Ethernet headers:
IPv4 Header (Layer 3)
| Field | Description |
|---|---|
| Source IP | Sender’s IPv4 address. |
| Dest IP | Recipient’s IPv4 address. |
| TTL | Time-to-live (prevents infinite loops). |
| Protocol | Higher-layer protocol (e.g., TCP, UDP). |
Ethernet Header (Layer 2)
| Field | Description |
|---|---|
| Source MAC | Sender’s MAC address. |
| Dest MAC | Recipient’s MAC address (FF:FF:FF:FF:FF:FF for broadcasts). |
| EtherType | Protocol type (0x0806 for ARP). |
| FCS | Frame Check Sequence (error detection). |
Practical Scenarios
Local Network Communication
Scenario: A laptop (192.168.1.10) pings a printer (192.168.1.20).
- The laptop checks its ARP cache for
192.168.1.20. - If no entry exists, it broadcasts an ARP request.
- The printer responds with its MAC address.
- The laptop updates its ARP cache and sends the ping.
Communicating with a Remote Server
Scenario: A PC (192.168.1.10) accesses 8.8.8.8 (Google DNS).
- The PC determines
8.8.8.8is not local and sends an ARP request for the default gateway (192.168.1.1). - The gateway responds with its MAC address.
- The PC forwards the packet to the gateway for routing.
Common Misconceptions
- ARP works across routers: False. ARP is local-only; routers use routing tables for inter-network communication.
- ARP is secure: False. ARP lacks authentication, making it vulnerable to spoofing attacks.
- IPv6 uses ARP: False. IPv6 uses NDP (Neighbor Discovery Protocol).
- ARP resolves IP routes: False. ARP resolves MAC addresses, not routing paths.
- MAC addresses are globally unique: False. MAC addresses can be spoofed or duplicated.
Security Risks and Mitigations
ARP’s lack of authentication introduces critical vulnerabilities:
Risks
- ARP Spoofing: Attackers send fake ARP replies to redirect traffic (e.g., man-in-the-middle attacks).
- ARP Cache Poisoning: Corrupting the ARP cache to misroute traffic.
Mitigations
- Static ARP entries: Manually configure critical mappings (e.g., for gateways).
- ARP Inspection: Network switches validate ARP traffic (e.g., Cisco’s Dynamic ARP Inspection).
- Encryption: Use VPNs or IPsec to protect data in transit.
Key Takeaways
- ARP dynamically maps IPv4 addresses to MAC addresses for local network communication.
- Defined in RFC 826, it operates between Layer 2 and Layer 3 of the OSI model.
- Uses broadcast requests and unicast replies to discover mappings.
- Results are stored in a temporary ARP cache to improve efficiency.
- Not used in IPv6 (replaced by NDP).
- Security risks: Unauthenticated and vulnerable to spoofing attacks.
Learn More
- RFC 826: Official ARP specification.
- ARP Commands:
- View ARP cache:
arp -a(Windows/Linux/macOS). - Clear ARP cache:
arp -d(Windows) orip -s -s neigh flush all(Linux).
- View ARP cache:
- Wireshark: Capture ARP traffic using filters like
arp. - IPv6 NDP: Learn how IPv6 replaces ARP with RFC 4861.
Visual Summary: ARP Resolution Flow
[Host A] (IP: 192.168.1.10, MAC: AA:AA:AA:AA:AA:AA)
│
│ ARP Request: "Who has 192.168.1.1?"
▼
[Broadcast on LAN]
│
▼
[Router] (IP: 192.168.1.1, MAC: BB:BB:BB:BB:BB:BB)
│
│ ARP Reply: "192.168.1.1 is at BB:BB:BB:BB:BB:BB"
▼
[Host A updates ARP cache]