• Glossary
  • What is ARP (Address Resolution Protocol)?

Security glossary

What is ARP (Address Resolution Protocol)?

Address Resolution Protocol (ARP) is a network protocol that maps an IPv4 address to the MAC address of a device on the same local network. It lets a host broadcast a request, receive a reply, and cache the result so it can address Ethernet frames correctly.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Address Resolution Protocol (ARP) is a network protocol that maps IPv4 addresses to MAC addresses on local network segments, enabling hosts to build Ethernet frames by resolving destination addresses through cached lookups, broadcast requests, and unicast replies. Organizations depend on ARP for nearly every IPv4 Ethernet network, but face operational challenges including duplicate IP addresses causing cache flips, stale entries after device replacement, and ARP spoofing attacks that lack authentication mechanisms. Administrators troubleshoot ARP issues using commands like arp -a to inspect caches and arp -d to clear stale entries, while implementing defenses such as dynamic ARP inspection, port security, and static entries to protect critical infrastructure from address resolution failures and traffic interception.

  • ARP operates at the Layer 2 and Layer 3 boundary by broadcasting requests across a local segment and caching IP-to-MAC mappings that expire after varying periods to prevent stale routing information.
  • Common ARP faults include duplicate IP addresses causing cache flips between multiple MAC addresses, wrong subnet masks triggering incomplete ARP resolution attempts, and broadcast storms on flat networks that consume switch CPU resources.
  • ARP lacks authentication as defined in RFC 826, making it vulnerable to spoofing attacks where any device can send unsolicited replies to redirect traffic, requiring defenses like dynamic ARP inspection and monitoring for unexpected IP-to-MAC changes.

ARP at a glance

AttributeValue
Full nameAddress Resolution Protocol
CategoryNetwork protocol
Defined inRFC 826
OSI layerLayer 2 and layer 3 boundary, carried directly in Ethernet frames
Primary useResolving IPv4 addresses to MAC addresses on a local network
Related termsMAC address, IPv4, IPv6, Neighbor Discovery Protocol, DHCP, ARP spoofing, VLAN

How ARP works

A host that wants to send an IPv4 packet to another device on its own subnet must know the destination MAC address before it can build an Ethernet frame. ARP supplies that mapping through a broadcast request and a unicast reply.

  1. Check the cache: The sending host looks in its ARP cache for an entry matching the destination IPv4 address. If a valid entry exists, it uses that MAC address and skips the remaining steps.
  2. Broadcast a request: If no entry exists, the host sends an ARP request to the broadcast MAC address. The request asks which device owns the target IPv4 address and carries the sender's own IP and MAC addresses.
  3. Receive a reply: Every device on the segment sees the request, but only the device that owns the target address answers. It sends a unicast ARP reply containing its MAC address.
  4. Cache the mapping: The requester stores the IP-to-MAC pair in its ARP cache and sends the original frame. Entries expire after a period that varies by operating system, so stale mappings are eventually removed.

When the destination is on another subnet, the host resolves the MAC address of its default gateway instead of the final destination. Administrators can inspect the cache with the arp -a command on most systems, and delete entries with arp -d. Commands such as show arp serve the same purpose on network devices. IPv6 does not use ARP; it relies on Neighbor Discovery Protocol.

Why ARP matters in enterprise networks

Nearly every IPv4 Ethernet network depends on ARP, even though users never see it. Each host and router keeps a cache, and a switch or router with many attached devices may hold thousands of entries. Because requests are broadcasts, a very large flat segment generates more broadcast traffic that every device must process, which is one reason networks are divided into smaller subnets and VLANs.

Operationally, ARP is a common first stop when troubleshooting connectivity. Viewing the cache shows whether a host has learned the right MAC address for a gateway or server. Duplicate IP addresses are a frequent fault: two devices claim one address, and the cache flips between their MAC addresses, causing intermittent failures. Clearing a stale entry with arp -d often restores connectivity after a device is replaced or an address is reassigned.

ARP has no authentication, as defined in RFC 826. Any device on the segment can send a reply, and many hosts accept unsolicited replies, which makes ARP spoofing possible. An attacker can redirect traffic through their own machine to intercept or alter it. Common defenses include dynamic ARP inspection on switches, port security, static entries for critical devices, and monitoring for unexpected changes in IP-to-MAC mappings.

Common ARP issues

Two devices claiming the same IPv4 address cause the ARP cache on other hosts to flip between two MAC addresses. Users see intermittent connectivity, and operating systems often log a conflict warning.

After a NIC swap or a failover, hosts may keep the old MAC address until the entry times out. Traffic goes to a device that no longer answers, and clearing the entry on the affected host usually restores connectivity.

ARP has no authentication, so any host on the segment can send replies that claim another device's IP address. An attacker can use this to intercept or redirect traffic, and the usual signs are a gateway IP mapped to an unexpected MAC address.

A layer 2 loop or a very large flat segment can multiply ARP broadcasts until devices spend noticeable resources processing them. Switch CPU load rises and applications slow down across the whole VLAN.

A host with a mask that is too wide sends ARP requests for addresses that are actually on another network. Nothing answers, so the entry shows as incomplete and the destination is unreachable.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

ARP FAQ

Related terms

Article

IPv4 (Internet Protocol version 4)

Internet Protocol version 4 (IPv4) is the fourth version of Internet Protocol using 32-bit addresses to route most current internet traffic; its global supply is exhausted.

Learn more
Article

Local Area Network (LAN)

A local area network (LAN) connects devices within a limited geographical area, such as an office, building, or campus, allowing them to communicate and share resources.

Learn more
Article

Subnet mask

A subnet mask is a 32-bit number that divides an IP address into network address and host address portions.

Learn more
Article

Default Gateway

A default gateway is the network device, typically a router, that forwards traffic from a local network to destinations outside its subnet.

Learn more
Article

IP Address Conflict

An IP address conflict occurs when two or more devices on a network are assigned the same IP address, disrupting network communication.

Learn more
Article

DHCP Snooping

DHCP snooping is a network security feature that monitors DHCP traffic and prevents unauthorized DHCP servers from assigning IP addresses to network devices.

Learn more
Article

OSI model

The OSI model is a conceptual model that characterizes and standardizes communication functions of telecommunications or computing systems.

Learn more
Article

Multicast

Multicast is group communication where data transmission is addressed to multiple destination computers simultaneously.

Learn more
Browse the full glossary