What Is ARP and How Do Devices Find Each Other on a Network?
Table of Contents
The Address Gap Between Layers
IP addresses identify devices across networks. MAC addresses identify devices on the local network segment. These two addressing systems operate at different layers (Layer 3 and Layer 2) and do not know about each other by default. When your computer wants to send a packet to another device on the same subnet, it knows the destination IP address but needs the destination MAC address to construct the Ethernet frame. ARP bridges this gap.
ARP (Address Resolution Protocol) maps IPv4 addresses to MAC addresses on local networks. It is simple, fast, and completely unauthenticated - which is both the reason it works so well and the reason it is a persistent security problem.
How ARP Works
The process has two steps: a broadcast request and a unicast reply.
ARP Request - the sender broadcasts an ARP request to every device on the local network (Ethernet broadcast address FF:FF:FF:FF:FF:FF). The request says: "Who has IP address 192.168.1.1? Tell 192.168.1.100." Every device on the segment receives this broadcast.
ARP Reply - the device that owns the requested IP address responds with a unicast ARP reply directly to the sender: "192.168.1.1 is at MAC address AA:BB:CC:DD:EE:FF." Only the owner of the IP address is supposed to respond.
The sender stores this IP-to-MAC mapping in its ARP cache and uses it to construct Ethernet frames for all subsequent packets to that destination. No further ARP exchanges are needed until the cache entry expires.
ARP operates below the IP layer. ARP packets are not IP packets - they have their own EtherType (0x0806) and their own frame format. They are local to the broadcast domain and never cross a router.
sequenceDiagram
participant A as Device A (192.168.1.50)
participant ALL as All Devices
participant B as Device B (192.168.1.1)
A->>ALL: ARP Request: Who has 192.168.1.1?
Note over ALL: Broadcast received by all
B->>A: ARP Reply: I am at AA:BB:CC:DD:EE:FF
Note over A: ARP cache updated
The ARP Cache
Every device maintains an ARP cache (also called the ARP table) that stores recent IP-to-MAC mappings. On most operating systems, cache entries expire after 15-20 minutes if not refreshed.
The cache prevents the device from sending a broadcast ARP request every time it sends a packet. For frequently communicated destinations (the default gateway, for example), the mapping stays in the cache and gets refreshed periodically.
You can inspect the ARP cache on most systems. On Linux and macOS, the command is arp -a. On Windows, arp -a works as well. The output shows each IP address, the corresponding MAC address, and whether the entry is dynamic (learned via ARP) or static (manually configured).
Gratuitous ARP
A gratuitous ARP is an ARP reply that nobody asked for. A device sends an unsolicited ARP reply announcing its own IP-to-MAC mapping. Legitimate uses include:
- Announcing a new IP address after a configuration change
- Updating caches after a failover (the backup server takes over the primary's IP with a different MAC)
- Detecting IP address conflicts (if another device responds to a gratuitous ARP for your IP, there is a conflict)
Gratuitous ARPs are accepted and cached by most operating systems without question. This is by design - it makes network recovery and failover faster. But it also means any device can announce any IP-to-MAC mapping, and everyone will believe it.
ARP Spoofing: The Core Attack
ARP has no authentication. There is no way for a device to verify that an ARP reply actually came from the owner of the claimed IP address. An attacker can send forged ARP replies associating any IP address with the attacker's own MAC address.
The classic ARP spoofing attack targets the default gateway. The attacker sends gratuitous ARP replies to every device on the network saying: "The gateway IP (192.168.1.1) is at my MAC address." Simultaneously, the attacker sends ARP replies to the real gateway saying: "The victim's IP is at my MAC address."
Now all traffic between the victim and the gateway flows through the attacker's machine. The attacker forwards the traffic to its real destination (so the victim does not notice the interruption), but can inspect, modify, or record everything in transit. This is a classic man-in-the-middle position.
The attack requires the attacker to be on the same broadcast domain as the target. It does not work across subnets or through routers, because ARP is a local protocol.
sequenceDiagram
participant V as Victim
participant ATK as Attacker
participant GW as Gateway
ATK->>V: Fake ARP: Gateway is at my MAC
ATK->>GW: Fake ARP: Victim is at my MAC
Note over ATK: Both ARP caches poisoned
V->>ATK: Outbound traffic
ATK->>GW: Forwards traffic
GW->>ATK: Response traffic
ATK->>V: Forwards response
Defenses Against ARP Attacks
Several defenses exist, though none are universally deployed:
- Static ARP entries - manually configuring the gateway's MAC address prevents ARP spoofing for that entry. This does not scale to large networks but is effective for critical mappings.
- Dynamic ARP Inspection (DAI) - a switch-level feature that validates ARP packets against a DHCP snooping database. Only ARP replies matching known DHCP-assigned IP-to-MAC pairs are forwarded.
- ARP monitoring tools - software like arpwatch monitors ARP traffic for unexpected changes in IP-to-MAC mappings and alerts when they occur.
- Encryption - HTTPS, SSH, and VPNs protect data even if the attacker achieves a man-in-the-middle position. The attacker can see the encrypted traffic but cannot read or modify it without breaking the encryption.
- 802.1X port authentication - preventing unauthorized devices from accessing the network in the first place eliminates the ability to launch ARP spoofing attacks.
ARP in Wireless Networks
ARP operates the same way on WiFi as on wired Ethernet. The same spoofing attacks apply. In fact, WiFi makes ARP spoofing easier in some ways - an attacker does not need physical access to a switch port, just proximity to the access point.
When the BLEShark Nano monitors WiFi traffic, ARP packets are visible in the captured frames (they travel inside 802.11 data frames). Unusual ARP patterns - rapid gratuitous ARPs, multiple devices claiming the same IP, or frequent ARP cache updates - can indicate an active ARP spoofing attack on the network being monitored.
IPv6 replaces ARP with Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages instead of a separate protocol. NDP has optional cryptographic protections (SEND - Secure Neighbor Discovery), though deployment remains limited.