# ARP

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/arp

## Quick definition

ARP stands for Address Resolution Protocol. It is a way for computers on the same local network to find each other's hardware addresses. When one computer wants to send data to another, it uses ARP to ask, 'Who has this IP address? Please tell me your MAC address.' The computer that owns that IP replies with its MAC address, and then the communication can begin.

## Simple meaning

Imagine you live in a large apartment building. Every apartment has an apartment number (like an IP address), but the postal service delivers mail based on the mailbox number (like a MAC address). When a new neighbor moves in, you don't know which mailbox belongs to which apartment. To send a letter, you go to the building's directory and look up the apartment number to find the mailbox number. ARP works exactly like that directory.

ARP, which stands for Address Resolution Protocol, is a fundamental part of how computers talk to each other on a local network. Every device that connects to a network, such as a laptop, smartphone, or printer, has two important identifiers: an IP address and a MAC address. The IP address is like the apartment number, and the MAC address is like the mailbox number. The IP address can change depending on the network, but the MAC address is permanently burned into the device's network card.

When your computer wants to send data to another device on the same network, it knows the destination's IP address but not its MAC address. This is a problem because data on a local network is actually sent using MAC addresses, not IP addresses. So your computer uses ARP to broadcast a question to every device on the network: 'Who has this IP address?' Only the device with that IP address responds with its MAC address. Your computer then stores this information in a small table called the ARP cache so it doesn't have to ask again next time.

Think of ARP like asking a question in a crowded room. You shout: 'Who is Alex?' Many people hear you, but only Alex says: 'I am Alex.' Now you know where Alex is and can talk directly. ARP is that shout and reply system for computers.

ARP is automatic and happens in the background, so users never see it. But network administrators and IT professionals need to understand it because ARP can be exploited by attackers. For example, a hacker can send fake ARP replies to trick your computer into sending data to them instead of the real destination. This is called ARP spoofing or ARP poisoning.

ARP is the bridge between IP addresses and MAC addresses. Without it, devices on a local network could not exchange data even if they had each other's IP addresses. It is a quiet but essential protocol that makes local networking work smoothly.

## Technical definition

ARP (Address Resolution Protocol) is a Layer 2 (Data Link Layer) and Layer 3 (Network Layer) protocol defined in RFC 826. Its primary function is to dynamically map a network layer address (IPv4 address) to a data link layer address (MAC address). ARP is essential for communication within a single broadcast domain, such as an Ethernet local area network (LAN).

The ARP protocol operates through a series of messages encapsulated directly within Ethernet frames. The two main message types are ARP request and ARP reply. An ARP request is a broadcast frame sent to the Ethernet broadcast address (FF:FF:FF:FF:FF:FF), which reaches every device on the local network segment. The request contains the sender's IP and MAC addresses, as well as the target IP address for which the corresponding MAC is sought. Every device on the network processes the request, but only the device whose IP matches the target IP responds with an ARP reply. The reply is unicast (sent directly back to the requester) and contains the target device's MAC address.

Once the MAC address is obtained, the requesting device updates its ARP cache, a table that stores IP-to-MAC mappings for a limited time. The cache entry is maintained for a period known as the ARP cache timeout (typically 15 to 300 seconds, depending on the operating system). If no communication occurs with that IP within the timeout, the entry is removed, and a fresh ARP request is needed for future communication. This aging mechanism ensures that stale or changed mappings are not used indefinitely.

ARP is tightly integrated with the IPv4 stack. When a host wants to send an IP packet to another host on the same subnet, it first checks its local ARP cache. If no mapping exists, it triggers an ARP request. The packet is then placed on hold until the MAC address is resolved. If the destination is on a different subnet, the packet is forwarded to the default gateway, and ARP is used to resolve the gateway's MAC address.

Several variations of ARP exist. Proxy ARP allows a router to respond to ARP requests on behalf of devices on a different network, making them appear reachable on the same subnet. Gratuitous ARP is an unsolicited ARP reply broadcast by a device to announce or update its IP-to-MAC mapping. This is commonly used during IP address conflict detection or when a device changes its MAC address (e.g., after a NIC replacement). Reverse ARP (RARP), defined in RFC 903, was an older protocol used by diskless workstations to discover their own IP address. RARP has been largely replaced by BOOTP and DHCP.

In modern networks, ARP remains a critical component, but it has inherent security vulnerabilities. Because ARP is stateless and relies on trust, any device on the network can send a spoofed ARP reply, claiming to have another device's IP. This can lead to man-in-the-middle attacks, where an attacker intercepts traffic between two legitimate hosts. Defenses include dynamic ARP inspection (DAI) on switches, which validates ARP packets against a trusted database, and static ARP entries for critical devices.

The ARP protocol does not exist for IPv6. Instead, IPv6 uses the Neighbor Discovery Protocol (NDP), which performs similar functions but with enhanced security features, such as the use of ICMPv6 messages and cryptographic protections.

From an implementation perspective, ARP operates as part of the operating system's network stack. In Linux, the ARP cache can be viewed and manipulated using commands like 'arp' and 'ip neigh'. In Windows, 'arp -a' displays the cache. Network professionals routinely examine ARP tables for troubleshooting connectivity issues, detecting duplicate IP addresses, or identifying potential ARP spoofing attacks.

## Real-life example

Imagine you are moving into a large office building for the first time. You know the name of the person you need to deliver a package to, but you do not know their desk number. The building has a main directory at the entrance that lists everyone's name and their desk number. However, the directory is not updated instantly. You need to find out the desk number to deliver the package directly.

So you stand at the entrance and shout loudly: 'Who is Sarah Johnson? Please tell me your desk number!' Your voice carries through the entire floor. Many people hear you, but only Sarah responds: 'I am Sarah Johnson, and my desk is number 307.' You now know the desk number and can walk directly there. You also note down Sarah's desk number for future reference so you don't have to shout again.

This is exactly how ARP works. In this analogy, the person's name is the IP address, and the desk number is the MAC address. Your shout is the ARP request broadcast. Sarah's reply is the ARP reply. Your mental note is the ARP cache. If you need to deliver another package to Sarah later, you check your notes first. If you find the desk number, you go directly. If you lost your notes, you shout again.

Now suppose someone else, named Dave, hears your shout but does not know Sarah. Dave could pretend to be Sarah and say: 'I am Sarah Johnson, my desk is 201.' He lies. You deliver the package to Dave's desk, and Sarah never gets it. This is ARP spoofing. Dave maliciously inserted a fake mapping into your notes, and you believed it.

In real networks, ARP requests are broadcast to every device on the local network segment, just as your shout was heard by everyone on your floor. The ARP reply is unicast, meaning only the original requester hears it. The ARP cache has a timeout because people change desks or leave the company. If you never visited Sarah for a month, you might forget where her desk is and need to ask again.

This analogy also explains why ARP is only used within the same local network. If you need to deliver a package to someone in a different building, you first deliver it to your building's mailroom, which sends it to the other building. In networking, the mailroom is the default gateway. ARP resolves the gateway's MAC address, not the final destination's MAC address, when the destination is on a different subnet.

## Why it matters

ARP matters because it is the glue that connects the logical IP layer to the physical hardware layer. Without ARP, no device on a local network could send an Ethernet frame to another device, even with correct IP addresses. Every time you browse the internet, send an email, or stream a video on your local network, ARP is quietly working in the background.

For IT professionals, understanding ARP is critical for network troubleshooting. A common issue is when two devices are assigned the same IP address. This causes ARP cache confusion, as the ARP table might point to the wrong device. Network connectivity becomes intermittent or fails entirely. Checking the ARP cache with commands like 'arp -a' helps identify these conflicts.

Security is another reason ARP matters. ARP lacks authentication, making it vulnerable to ARP spoofing attacks. An attacker on the same network can poison the ARP cache of your device and the default gateway, redirecting all traffic through the attacker's machine. This allows the attacker to capture passwords, emails, or other sensitive data. Network administrators must deploy defenses like Dynamic ARP Inspection (DAI) to protect against these attacks.

ARP also affects network performance. A large network with many devices can generate significant ARP broadcast traffic, especially when hosts are probing for live IP addresses. This can consume bandwidth and CPU cycles on switches and endpoints. Understanding ARP caching and timeout settings helps network designers optimize traffic.

Finally, ARP is a fundamental concept tested in major IT certifications. Knowing how ARP works, its limitations, and its security implications is essential for passing exams like CompTIA Network+, CCNA, and Security+. Mastery of ARP is not just about memorizing the acronym; it is about understanding how data moves from one device to another at the lowest level.

## Why it matters in exams

ARP is a highly tested topic across multiple IT certification exams. In CompTIA Network+ (N10-008), ARP appears in Domain 1.0 (Networking Fundamentals) and Domain 5.0 (Network Troubleshooting). Candidates must understand the ARP process, the purpose of the ARP cache, and how to use the 'arp' command for troubleshooting. Questions may ask what happens when a device sends a packet to an IP on the same subnet but the ARP cache is empty. The correct answer involves a broadcast ARP request.

For CCNA (200-301), ARP is covered under Network Access and IP Connectivity sections. Cisco expects candidates to understand ARP operation in Ethernet networks, the difference between ARP request and ARP reply, and the role of proxy ARP. Troubleshooting scenarios often involve examining ARP tables on routers to verify that Layer 2 mappings are correct. Proxy ARP questions may ask when a router should respond to an ARP request on behalf of another device.

In CompTIA Security+ (SY0-601), ARP is discussed in the context of network attacks. ARP spoofing and ARP poisoning are common topics. Questions might describe a man-in-the-middle attack scenario and ask which protocol is being exploited. The candidate must identify ARP as the vulnerable protocol and suggest mitigation techniques like static ARP entries or dynamic ARP inspection.

For AWS Solutions Architect Associate (SAA-C03), ARP knowledge is less direct but appears in the context of VPC networking. Understanding how ARP operates in a virtualized environment helps when troubleshooting connectivity between EC2 instances on the same subnet. The AWS hypervisor handles ARP internally, but knowing that instances can only communicate within the same VPC subnet via ARP-like mechanisms is important.

Microsoft Azure (AZ-104) and Google ACE also touch on ARP indirectly. In Azure, the virtual network handles address resolution, but understanding the concept helps when configuring VPN gateways or site-to-site connections where ARP may traverse tunnels.

Exam questions on ARP can be multiple-choice, scenario-based, or command-line interpretation. For example, a question might show the output of 'arp -a' on a Windows machine and ask which device is the default gateway. Another might ask what happens to a pending IP packet while ARP is resolving the MAC address. The answer is that the packet is queued until the MAC is known.

To succeed on ARP questions, learners should memorize the following: ARP is a broadcast for request, unicast for reply. ARP operates at Layer 2 and Layer 3. The ARP cache stores IP-to-MAC mappings temporarily. ARP spoofing is a Layer 2 attack. Without ARP, devices on the same network cannot communicate at all.

## How it appears in exam questions

ARP questions typically fall into three categories: conceptual, troubleshooting, and security. Conceptual questions test your understanding of the ARP process itself. For example: 'What protocol is used to map an IPv4 address to a MAC address?' or 'Which type of address is used in an ARP request?' The answer is broadcast MAC address (FF:FF:FF:FF:FF:FF). Another common question: 'When a host sends a packet to another host on the same network, what happens if the destination MAC is not in the ARP cache?' The correct answer: the source host sends an ARP request broadcast.

Troubleshooting questions present a scenario where connectivity is broken. For instance: 'A user reports that they cannot access the internet. Other devices on the same network are working. You run the command 'arp -a' and see an incomplete entry for the default gateway IP. What is the most likely cause?' The answer involves a missing or incorrect ARP mapping for the gateway, possibly due to a misconfigured NIC or a duplicate IP address. Another scenario: 'After replacing a faulty switch, several workstations cannot communicate with the server. You check the ARP table on the server and see that the MAC addresses of the workstations are correct. What else should you check?' The answer might be the switch MAC address table or VLAN configuration.

Security-focused questions often describe an attack. Example: 'An administrator suspects an ARP spoofing attack. Which tool can be used to dynamically inspect ARP packets on a Cisco switch?' The answer is Dynamic ARP Inspection (DAI). Another question: 'An attacker on the same subnet as the victim sends gratuitous ARP replies claiming to be the default gateway. What is this attack called?' The answer is ARP spoofing or ARP poisoning.

Some questions combine multiple concepts. For example: 'A router receives an IP packet destined for a host on a directly connected network. The router checks its routing table and finds the correct entry. It then checks its ARP cache but finds no entry for the destination IP. What happens next?' The answer: the router sends an ARP request on that interface. The question tests the understanding that ARP resolution happens before the Ethernet frame is built.

Command-based questions may show the output of 'arp -a' and ask to identify the MAC address of a specific IP. Or they may ask what flag appears for an unresolved entry (e.g., 'incomplete' in Windows, 'FAILED' or 'STALE' in Linux).

To perform well, focus on the ARP process order: (1) check cache, (2) if miss, send broadcast request, (3) target responds with unicast reply, (4) populate cache, (5) send data. Also remember that ARP responses are not authenticated, which is why spoofing is possible.

## Example scenario

You are a network technician at a small office. An employee named Priya calls you because she cannot print to the office printer. Other employees can print without issues. Priya's computer has an IP address of 192.168.1.12. The printer has a static IP of 192.168.1.50. Both are on the same subnet (255.255.255.0). You start troubleshooting by opening a command prompt on Priya's computer and typing 'arp -a'. You see only one entry: the default gateway (192.168.1.1) with its MAC address. There is no entry for 192.168.1.50. This tells you that Priya's computer has never successfully communicated with the printer.

Next, you ping the printer from Priya's computer: ping 192.168.1.50. The ping fails with 'Destination Host Unreachable'. You suspect an ARP problem because the ping process sends an ARP request to find the printer's MAC address, but it gets no reply. You check the printer: it is powered on, connected to the switch, and the network LED is blinking. You check the switch port configuration and see that port is in the correct VLAN. Then you remember that the printer has a static IP, but someone might have changed it. You check the printer's network settings from its control panel. You discover that its IP address has been changed to 192.168.1.55, not 192.168.1.50. That is why Priya's computer could not resolve the MAC address for 192.168.1.50, no device owns that IP. You correct the printer's IP back to 192.168.1.50 and restart its network interface. You then run 'arp -d' on Priya's computer to clear the cache, and ping the printer again. This time, the ping succeeds. ARP automatically adds the correct MAC entry for the printer. Priya can now print.

This scenario illustrates how ARP is the first step in any local communication. Without a successful ARP resolution, no data can be sent. It also shows how a misconfigured IP address can break ARP resolution, leading to a complete connectivity failure for that specific device.

## Common mistakes

- **Mistake:** Thinking ARP is used for all network communication, including across routers
  - Why it is wrong: ARP only works within the same broadcast domain (i.e., the same subnet). When a packet is sent to a different subnet, the source device uses ARP to find the MAC address of its default gateway, not the final destination.
  - Fix: Remember that ARP resolves the next-hop MAC address, which is typically the gateway when crossing subnets.
- **Mistake:** Confusing ARP requests as unicast messages
  - Why it is wrong: ARP requests are broadcast frames sent to all devices on the local network. They are not unicast because the requester does not know the target's MAC address. Only the ARP reply is unicast.
  - Fix: Memorize: ARP request is broadcast, ARP reply is unicast.
- **Mistake:** Believing that ARP entries are permanent
  - Why it is wrong: ARP cache entries are temporary and have a timeout. If no communication occurs, the entry is removed to avoid using stale mappings. Static ARP entries can be configured, but dynamic entries age out.
  - Fix: Remember that ARP entries expire after a short time (typically 15–300 seconds).
- **Mistake:** Thinking that ARP is secure because it is automatic
  - Why it is wrong: ARP has no authentication mechanism. Any device on the network can send a fake ARP reply, leading to spoofing attacks. Automatic does not mean secure.
  - Fix: Always consider ARP as an unsecured protocol. Use security features like Dynamic ARP Inspection where possible.
- **Mistake:** Confusing ARP with DNS
  - Why it is wrong: DNS resolves domain names to IP addresses. ARP resolves IP addresses to MAC addresses. They operate at different layers and solve different problems.
  - Fix: DNS maps names to IPs; ARP maps IPs to MACs.
- **Mistake:** Believing that IPv6 uses ARP
  - Why it is wrong: IPv6 does not use ARP. It uses Neighbor Discovery Protocol (NDP) which functions similarly but uses ICMPv6 messages and includes security features like Secure Neighbor Discovery (SEND).
  - Fix: ARP is for IPv4 only.

## Exam trap

{"trap":"In an exam scenario, a question describes a host sending a packet to a destination on a different subnet. The trap asks: 'Which MAC address does the source host include in the Ethernet frame?' The wrong answer is the destination host's MAC address.","why_learners_choose_it":"Learners often think the frame must contain the final destination's MAC address because that is where the packet is going. They overlook the role of the default gateway.","how_to_avoid_it":"When the destination IP is on a different subnet, the source host knows it cannot reach it directly. It sends the frame to the default gateway. The destination MAC in the Ethernet frame is the MAC address of the gateway, not the final host. The gateway then routes the packet. Always ask: 'Is the destination on the same subnet?' If no, ARP resolves the gateway's MAC."}

## Commonly confused with

- **ARP vs DNS:** DNS (Domain Name System) translates human-friendly domain names like 'courseiva.com' into IP addresses. ARP translates IP addresses into MAC addresses. DNS operates at the Application Layer (Layer 7), while ARP operates at the Data Link and Network Layers (Layers 2 and 3). (Example: DNS is like looking up a friend's phone number in a contact list. ARP is like using that phone number to find which physical phone (device) to call on a local phone system.)
- **ARP vs RARP (Reverse ARP):** RARP is an older protocol that does the opposite of ARP: it maps a MAC address to an IP address. It was used by diskless workstations to discover their own IP. RARP is obsolete and has been replaced by BOOTP and DHCP. ARP is still widely used. (Example: If ARP is asking 'What is your hardware address?', RARP asks 'What is your IP address?')
- **ARP vs NDP (Neighbor Discovery Protocol):** NDP is the IPv6 equivalent of ARP. It performs address resolution, router discovery, and duplicate address detection using ICMPv6 messages. NDP includes security features (like SEND) that ARP lacks. (Example: Think of NDP as the modern, more secure version of ARP designed specifically for IPv6 networks.)
- **ARP vs Proxy ARP:** Proxy ARP is a feature that allows a router to respond to an ARP request on behalf of a device on another network. It makes the remote device appear as if it is on the same subnet. Standard ARP only works within the same broadcast domain. (Example: A router pretending that a faraway printer is actually in the same room, so that computers can send traffic to it without knowing it is remote.)

## Step-by-step breakdown

1. **Application generates data** — A user application, like a web browser or email client, creates data that needs to be sent to another device. The application uses the destination IP address (e.g., 192.168.1.50).
2. **Check destination subnet** — The operating system checks whether the destination IP is on the same local subnet by comparing the IP address and subnet mask. If it is on the same subnet, the next step is ARP resolution for that IP. If it is on a different subnet, ARP will be used to resolve the default gateway's IP instead.
3. **Consult the ARP cache** — The OS first checks its local ARP cache for an entry matching the target IP (either the destination or the gateway). If an entry exists and is not expired, the corresponding MAC address is used immediately.
4. **Send ARP request broadcast** — If no matching cache entry is found, the OS constructs an ARP request packet. This packet contains the sender's IP and MAC addresses and the target IP address. The request is encapsulated in an Ethernet frame with a destination MAC of FF:FF:FF:FF:FF:FF (broadcast) and sent out the network interface.
5. **All devices process the request** — Every device on the local network segment receives the broadcast frame. Each device checks the target IP address against its own IP configuration. Devices that do not match silently discard the request.
6. **Target device sends ARP reply** — The device that owns the target IP address responds with an ARP reply. The reply includes its own MAC address and is sent as a unicast frame directly back to the original requester's MAC address.
7. **Update ARP cache** — Upon receiving the ARP reply, the requesting OS extracts the MAC address and creates a new entry in its ARP cache, associating the target IP with that MAC. A timer starts for this entry.
8. **Build Ethernet frame and send data** — Now that the MAC address is known, the OS constructs the original IP packet inside an Ethernet frame with the correct destination MAC address. The frame is transmitted onto the network, and the data reaches the intended device.

## Practical mini-lesson

In a real-world network, ARP is an invisible but essential process. As an IT professional, you will interact with ARP primarily through troubleshooting and security. Start by learning how to view and manage the ARP cache on different operating systems. On Windows, open a command prompt and type 'arp -a'. This lists all current IP-to-MAC mappings. If you see 'incomplete' for an IP, it means the ARP request failed to get a reply. On Linux, use 'ip neigh show' or 'arp -n'. Similar to Windows, entries can appear as 'REACHABLE', 'STALE', 'FAILED', or 'DELAY', each indicating the state of the mapping.

When troubleshooting connectivity issues, ARP is your first clue. If a device cannot communicate with another on the same subnet, check the ARP cache first. If the target IP is missing, try pinging it. The ping will trigger an ARP request. If the ping remains unreachable but other devices can reach the target, the problem is likely specific to the ARP resolution path, such as a firewall blocking ARP or a VLAN mismatch. If no device can reach the target, the issue might be at the switch level (e.g., port security or VLAN misconfiguration) or the target itself is offline.

Security professionals must understand ARP spoofing. An attacker on the same network can send gratuitous ARP replies, claiming to be the default gateway. This poisons the victim's ARP cache, causing all internet-bound traffic to go through the attacker. To detect this, compare the MAC address of the default gateway in the ARP cache with the known legitimate MAC. Tools like 'arpwatch' can monitor for ARP changes. Defenses include using Dynamic ARP Inspection on managed switches, which validates ARP packets against a DHCP snooping binding table, and configuring static ARP entries for critical devices.

In a configuration context, static ARP entries can be set on routers and servers for security or reliability. For example, on a Cisco router: 'arp 192.168.1.1 aaaa.bbbb.cccc arpa'. This binds a specific IP to a specific MAC, preventing spoofing. However, static entries require manual updates if hardware changes.

Common mistakes in practice include forgetting to clear stale ARP entries after moving a device to a different subnet, which causes packets to go to the wrong MAC. Also, do not assume that a successful ping means ARP is fine; the ping itself might be successful because ARP worked, but other services could be failing due to higher-layer issues.

ARP is the bedrock of local network communication. Master the commands, understand the cache states, and always suspect ARP when local connectivity breaks. For security, treat ARP as an untrusted protocol and deploy appropriate safeguards.

## Commands

```
arp -a
```
Displays the current ARP cache on Windows systems, showing IP-to-MAC address mappings for all interfaces.

*Exam note: Commonly tested in A+ and Network+ to verify ARP table contents; exams ask which command shows cached MAC addresses.*

```
ip neigh show
```
Displays the ARP cache (neighbor table) on Linux systems using iproute2.

*Exam note: Appears in CCNA and Linux+ for identifying neighbors; tests knowledge of ip vs arp commands.*

```
show ip arp
```
Displays the ARP table on Cisco devices (routers/switches), showing IP, MAC, interface, and age.

*Exam note: Key CCNA command; exams ask to verify directly connected host mappings or troubleshoot incomplete entries.*

```
arp -d 192.168.1.1
```
Deletes a specific ARP entry for IP 192.168.1.1 from the cache on Windows.

*Exam note: Tested in troubleshooting scenarios where stale entries cause connectivity issues; A+ and Network+ ask how to clear ARP.*

```
clear arp-cache
```
Clears the entire ARP table on Cisco IOS devices (privileged exec mode).

*Exam note: CCNA exam expects you to know this command to force new ARP resolution after topology changes.*

```
arp -s 10.0.0.5 00-11-22-33-44-55
```
Creates a static ARP entry on Windows, permanently mapping 10.0.0.5 to MAC 00-11-22-33-44-55.

*Exam note: Security+ exams test static ARP as a defense against ARP spoofing; also appears in CCNA for managing critical hosts.*

```
ip route 0.0.0.0 0.0.0.0 serial0/0/0 arp
```
Configures ARP-based next-hop resolution on Cisco routers for point-to-point links.

*Exam note: Advanced CCNA topics; tests understanding of ARP on serial links vs Ethernet.*

## Troubleshooting clues

- **Stale ARP entry after IP change** — symptom: Host A cannot reach Host B after Host B changed IP address, but MAC address is the same.. ARP cache still contains the old IP-to-MAC mapping, causing packets to be sent to the wrong device or dropped. (Exam clue: Exams present a scenario where a device is pingable by IP but not by name after IP change; answer is clear ARP cache.)
- **Incomplete ARP entry** — symptom: arp -a shows 'incomplete' for a host; ping fails consistently.. The host sent an ARP request but received no reply; possible reasons include wrong VLAN, host powered off, or firewall blocking ARP. (Exam clue: CCNA questions show 'incomplete' in show ip arp; answer is verify host connectivity or check switch port.)
- **ARP spoofing / cache poisoning** — symptom: Intermittent connectivity; traffic to a server goes to an attacker instead.. Attacker sends forged ARP replies to associate their MAC with a legitimate IP, redirecting traffic. (Exam clue: Security+ and Network+ ask to identify attack via MAC address mismatches; remediation includes static ARP or DAI.)
- **Duplicate IP address detected** — symptom: Both Windows and Cisco devices log 'Duplicate IP address' conflict; connectivity drops.. Two devices respond to ARP requests for the same IP, causing cache instability and packet loss. (Exam clue: Exams test troubleshooting with 'show ip arp' showing two MACs for one IP; answer is resolve IP conflict.)
- **ARP broadcast storm** — symptom: Network slowdown; switch CPU high; excessive ARP broadcasts captured.. A misconfigured device or loop causes constant ARP requests, overwhelming network resources. (Exam clue: CCNA troubleshooting: identify cause as broadcast storm; solutions include STP, storm control, or isolating faulty device.)
- **Proxy ARP misconfiguration** — symptom: Hosts on different subnets can ping each other unexpectedly; routing confusion.. A router with proxy ARP enabled replies to ARP requests for hosts on other networks, causing hosts to think they are directly connected. (Exam clue: Network+ and CCNA ask why hosts across routers can ping; answer is proxy ARP enabled on the router interface.)
- **Gratuitous ARP causing IP conflict** — symptom: After deploying a new VM, existing host logs IP conflict and loses network access.. New device sends a gratuitous ARP with an IP already in use, triggering conflict detection and cache update. (Exam clue: AWS SAA and Azure AZ-104 test understanding of VPC/network interfaces; conflict arises if IP not properly freed.)

## Memory tip

Remember: 'ARP request is a shout, ARP reply is a whisper.' The request is a broadcast (everyone hears it), the reply is unicast (only the requester hears it).

## FAQ

**What happens if two devices on the same network have the same IP address?**

This is called an IP address conflict. Both devices will respond to ARP requests for that IP, causing the ARP cache to oscillate between two MAC addresses. Network connectivity becomes unreliable as packets may go to the wrong device.

**Can ARP work across a router?**

No, ARP only works within the same broadcast domain (i.e., the same subnet). A router stops Ethernet broadcasts, so an ARP request cannot cross a router. For communication across subnets, ARP resolves the MAC of the router's interface.

**Why does my ARP cache show incomplete entries?**

An 'incomplete' entry means an ARP request was sent but no reply was received. This usually indicates the target device is offline, the device is on a different VLAN, or a firewall is blocking ARP.

**What is the difference between ARP and a MAC address table?**

An ARP table maps IP addresses to MAC addresses on a host or router. A MAC address table is used by switches to map MAC addresses to switch ports. They operate at different devices: ARP is on endpoints and routers; MAC tables are on switches.

**Does ARP use TCP or UDP?**

Neither. ARP is a Layer 2 and Layer 3 protocol that operates directly over Ethernet frames. It does not use TCP or UDP port numbers. It has its own EtherType value (0x0806).

**How can I protect my network from ARP spoofing?**

Use Dynamic ARP Inspection (DAI) on managed switches, which validates ARP packets against a DHCP snooping database. Alternatively, configure static ARP entries for critical devices or use software like ArpON or arptables on Linux.

**Is there an ARP equivalent for IPv6?**

Yes, IPv6 uses Neighbor Discovery Protocol (NDP). NDP uses ICMPv6 messages (Neighbor Solicitation and Neighbor Advertisement) to perform address resolution, along with router discovery and other functions.

**What is a gratuitous ARP?**

A gratuitous ARP is an unsolicited ARP reply broadcast by a device to announce its IP-to-MAC mapping. It is often used when a device changes its IP or MAC address, or to check for IP conflicts.

## Summary

ARP, or Address Resolution Protocol, is a foundational networking protocol that maps IP addresses to MAC addresses within a local network. Without ARP, devices could not deliver Ethernet frames to each other, making local network communication impossible. It operates through a simple process: a broadcast request asking 'who has this IP?' followed by a unicast reply from the device that owns that IP. The mapping is stored temporarily in the ARP cache, which must be refreshed periodically.

For IT certification candidates, understanding ARP is crucial. It appears in exams like CompTIA Network+, CCNA, and Security+ in conceptual, troubleshooting, and security contexts. You must know that ARP requests are broadcast and replies are unicast, that ARP only works within the same subnet, and that it is vulnerable to spoofing attacks. Exam traps often involve the default gateway scenario, where learners mistakenly think the destination MAC is the final host instead of the gateway.

In practice, ARP is a first-line troubleshooting tool. Commands like 'arp -a' (Windows) and 'ip neigh' (Linux) help diagnose connectivity issues. Security professionals must protect against ARP poisoning using mechanisms like Dynamic ARP Inspection. Whether you are a beginner or an experienced network engineer, mastering ARP is essential because it is the silent backbone of every local network communication. Study the process, practice the commands, and always keep the security implications in mind.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/arp