Section 3: ARP (Address Resolution Protocol)

The Big Picture: Knowing the Street Address but Not the Name

Your PC wants to send a message to 192.168.1.1 (the router). It knows the IP address. But the NIC can only build an Ethernet frame (Section 1) if it knows the MAC address of the receiver. The switch also forwards frames by MAC, not by IP.

So there is a gap: you have the IP, and you need the MAC. Imagine you want to visit "the person who lives at 12 Oak Street", but you must call out their name at the door. You stand in the street and shout: "Who lives at 12 Oak Street? Please tell me your name!" The right person answers.

That is exactly what ARP does, on the network.

3.1 Mapping an IP Address to a MAC Address

What it is: ARP (Address Resolution Protocol) finds the MAC address that belongs to an IP address on the same local network. It sits between the Internet layer (IP) and the Link layer (Ethernet).

Important: ARP works only on the local network. If the target is on another network, your PC does not ARP for it. It ARPs for the default gateway instead, and sends the frame to the router (Sections 2 and 8).

The steps:

 PC A (192.168.1.25)                                        PC B (192.168.1.40)
 MAC: AA-AA-AA-00-00-01                                     MAC: BB-BB-BB-00-00-02

 "I want to send to 192.168.1.40, but I do not know its MAC."

 1. ARP REQUEST (broadcast, to FF-FF-FF-FF-FF-FF):
    "Who has 192.168.1.40?  Tell 192.168.1.25."  ─────────────────────────►  every device
                                                                             on the network
                                                                             hears this
 2. Only B has that IP, so only B answers.

 3. ARP REPLY (unicast, only to A):
    "192.168.1.40 is at BB-BB-BB-00-00-02."  ◄────────────────────────────  B

 4. A saves the answer in its ARP cache (3.2) and sends the real frame to
    BB-BB-BB-00-00-02.

Why a broadcast for the question? A does not know B's MAC yet, so it cannot address B. It uses the broadcast address FF-FF-FF-FF-FF-FF. The switch sends it out of all ports and every device on the network reads it. Devices that do not own that IP ignore it. B answers directly to A's MAC (which was inside the request), so the reply is not a broadcast.

What is inside an ARP message:

A nice side effect. Everybody who hears the request also learns A's MAC and IP, so they often store it too. That saves them from asking later.

Where ARP sits in a frame. An ARP message is carried directly inside an Ethernet frame whose Type field says "ARP" (Section 1.3). It does not use IP or TCP.

ARP has no security. Anyone on the local network can send a false ARP reply ("I am the router!"). That attack is called ARP spoofing. It is one reason to only use networks you trust, and why Wi-Fi encryption and switch security features exist. In this course you only look at ARP; you do not attack with it.

IPv6 note. IPv6 does not use ARP. It uses a similar job done by NDP (Neighbor Discovery Protocol). The idea is the same.

3.2 The ARP Cache

What it is: Asking "who has this IP?" for every single frame would flood the network. So each PC keeps a small table of recent answers called the ARP cache (or ARP table). The next frame to the same IP uses the table and no question is needed.

Entry types:

• Dynamic entries were learned from replies. They expire after a short time (typically from tens of seconds to a few minutes if unused), then ARP asks again. This keeps the table correct when a device is replaced or gets a new IP.
• Static entries are fixed. Windows adds some by itself (like the broadcast address and multicast addresses).

See your own ARP cache (read-only):

arp -a

What you will see (your numbers will differ):

Interface: 192.168.1.25 --- 0x7
  Internet Address      Physical Address      Type
  192.168.1.1           a4-5e-60-12-9b-c7     dynamic
  192.168.1.40          bb-bb-bb-00-00-02     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static

How to read it:

Try it yourself (safe): run arp -a, then ping your router (for example ping 192.168.1.1), then run arp -a again. If the router was not listed before, it now appears. You have just made your PC send an ARP request.

Typical problems and what they mean:

Windows tip: Deleting the whole cache needs an administrator window and is not needed in this course. Windows clears dynamic entries on its own after a short time.

Summary