ARP
The Address Resolution Protocol (ARP) links layer 2 (Ethernet) and layer 3 (IP) by mapping IP addresses to MAC addresses. Defined in RFC 826, ARP is a fundamental protocol for local network communication.
How ARP works
An ARP request broadcasts “to” a particular IP address using the broadcast MAC address (ff:ff:ff:ff:ff:ff). The host that owns that IP address replies directly (non-broadcast) to the requester. Because the reply contains both the MAC and IP address, the requester learns the mapping by the reply’s very existence.
ARP message headers contain two operation codes:
- REQUEST (1) — Broadcast query for an IP-to-MAC mapping.
- REPLY (2) — Unicast response providing the requested mapping.
Because ARP binds a MAC address to an IP address, it is necessarily limited to the current subnet (local broadcast domain). ARP traffic cannot cross routers.
Security considerations
ARP is unauthenticated and stateless. Any host on the local segment can send a reply claiming to own any IP address, which is the basis for ARP spoofing/poisoning attacks. This makes ARP a common vector for man-in-the-middle attacks on local networks.
Related techniques
- arp-scanning — Using ARP requests for stealthy host discovery on the local segment.
Sources
Related: mac-address, arp-scanning, tcp, wireshark