ARP

The Address Resolution Problem

IP addresses identify devices logically, but data on a local network is actually delivered using hardware MAC addresses. When a device wants to send a packet to another device on the same subnet, it knows the destination IPv4Internet Protocol version 4. The fourth revision of IP using 32-bit addresses (e.g., 192.168.1.1), providing approximately 4.3 billion unique addresses. Still the most widely used internet protocol despite address exhaustion. address but needs to know the corresponding MAC address to construct the Ethernet frame. ARP (Address Resolution Protocol) solves this by broadcasting a query — "Who has IP 192.168.1.1? Tell me your MAC" — and the owner of that IP responds with its MAC address.

ARP Cache

To avoid broadcasting for every packet, each device maintains an ARP cache: a short-lived table mapping IP addresses to MAC addresses. Entries typically expire after a few minutes. You can inspect this table with arp -a on most operating systems. When a DHCPDynamic Host Configuration Protocol. A network protocol that automatically assigns IP addresses, subnet masks, gateways, and DNS servers to devices when they join a network. server assigns a new IP or a device changes its network card, the cache may hold stale entries briefly until they expire or are flushed.

ARP Spoofing and Security

Because ARP has no built-in authentication, an attacker on the same network segment can send forged ARP replies that associate their own MAC with a legitimate GatewayA network device (typically a router) that serves as the access point from a local network to other networks. The default gateway is the first hop for traffic destined outside the local subnet. IP. Devices update their ARP caches with these replies, causing them to send traffic to the attacker instead of the real gateway — a classic Man-in-the-Middle AttackAn attack where an adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly. HTTPS and certificate pinning are primary defenses against this attack. setup. Defenses include Dynamic ARP Inspection (DAI) on managed switches, which validates ARP packets against trusted DHCPDynamic Host Configuration Protocol. A network protocol that automatically assigns IP addresses, subnet masks, gateways, and DNS servers to devices when they join a network. bindings, and static ARP entries for critical infrastructure.