Overview
ARP (Address Resolution Protocol) solves a specific, essential problem: a host knows another host's IP address on the local network but needs its MAC address to actually deliver a frame. This lesson focuses on ARP's purpose and its role in local delivery (building on the Ethernet module).
Learning objectives
- State the precise problem ARP solves.
- Describe the ARP cache and its lifecycle.
- Explain ARP's scope (local segment only).
Core concept
ARP's purpose is IP-to-MAC resolution on a local network. Layer 3 uses IP addresses, but actual local delivery at Layer 2 needs MAC addresses. ARP fills that gap: given a local IP, it discovers the matching MAC so a frame can be correctly addressed.
Each host keeps an ARP cache (ARP table) of recently learned IP→MAC mappings, so it does not have to ask every time. Entries expire after a period, ensuring stale mappings eventually clear (for example, if a device's interface changes).
How it works
When a host needs to send to a local IP not in its cache, it broadcasts an ARP request; the owner replies with its MAC; the host caches the mapping and sends the frame. Crucially, ARP operates only within a single local segment (broadcast domain) — it cannot resolve addresses across routers. To reach a remote network, a host instead resolves the gateway's MAC via ARP and hands the packet to the gateway.
Practical example
You can inspect your device's ARP cache with the arp -a command, which lists the IP→MAC mappings it has learned (your gateway, nearby devices). Watching an entry appear after you first contact a new local host — and disappear after a period of inactivity — shows ARP's caching and expiry in action.
Cybersecurity relevance
Because ARP resolves the gateway and local hosts and trusts replies without authentication, it is the target of ARP spoofing (a man-in-the-middle technique covered in offensive modules). Monitoring the ARP cache for suspicious changes (e.g. the gateway's MAC suddenly changing) is a defensive detection method.
Common mistakes
- Expecting ARP to work across networks — it is local-segment only; routers do not forward ARP.
- Ignoring cache expiry, forgetting that mappings are temporary and refreshed.
Key takeaways
- ARP resolves a local IP address to its MAC address so frames can be delivered at Layer 2.
- Hosts cache mappings in an ARP table with expiring entries.
- ARP works only within the local segment; for remote destinations it resolves the gateway's MAC instead.
Check your understanding
- What exact problem does ARP solve, and at which layers does it operate?
- Why can't ARP resolve the MAC address of a host on a different network?