Overview
Hosts communicate locally by MAC address but are configured with IP addresses. ARP (Address Resolution Protocol) is the bridge that maps an IP address to its MAC address on a local network. This lesson explains that crucial relationship and why it is a security weak point.
Learning objectives
- Explain the purpose of ARP.
- Describe the ARP request/reply process.
- Understand why ARP is vulnerable to spoofing.
Core concept
To send a frame to a host on the local network, a device needs the destination's MAC address — but it usually only knows the destination's IP address. ARP resolves this by asking, in effect, "Who has this IP? Tell me your MAC." The answer lets the sender build a correctly addressed frame. ARP thus connects Layer 3 (IP) to Layer 2 (MAC) on a local segment.
How it works
The ARP process:
- A host wants to reach
192.168.1.20on its LAN but lacks its MAC. - It broadcasts an ARP request to everyone on the segment: "Who has
192.168.1.20?" - The host with that IP replies with an ARP reply containing its MAC.
- The sender caches the IP→MAC mapping in its ARP table and sends the frame.
The cache avoids repeating the lookup for every frame. Entries expire after a time so changes are eventually reflected.
Practical example
Your laptop wants to reach the router at 192.168.1.1 to reach the internet. It broadcasts an ARP request; the router replies with its MAC; your laptop caches 192.168.1.1 → router's MAC and sends its frames there. You can view these learned mappings with the arp command on most systems — a direct look at the IP-to-MAC relationships your device has discovered.
Cybersecurity relevance
ARP has no authentication — a host simply trusts ARP replies. This enables ARP spoofing/poisoning, where an attacker on the LAN sends forged replies claiming that the router's IP maps to the attacker's MAC. Victims then send their traffic to the attacker, enabling man-in-the-middle interception. This is a foundational local-network attack studied in ethical hacking, and it is why network segmentation and monitoring for ARP anomalies matter.
Common mistakes
- Assuming ARP is secure — it trusts unauthenticated replies, its core weakness.
- Confusing ARP (IP→MAC on a LAN) with DNS (name→IP) — different mappings at different layers.
Key takeaways
- ARP maps a known IP address to its MAC address on the local network, bridging Layer 3 and Layer 2.
- It works by broadcasting a request and caching the reply in an ARP table.
- ARP has no authentication, making ARP spoofing a common man-in-the-middle attack on local networks.
Check your understanding
- Walk through the ARP request/reply steps to find a local host's MAC.
- Why does the lack of authentication in ARP enable man-in-the-middle attacks?