ARP: from IP to MAC
Your computer knows the IP address it wants to reach, but Ethernet only delivers frames to MAC addresses. Watch ARP fill the gap on a small home network: one question shouted to everyone, one quiet answer, and a cache so the question rarely has to be asked again.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01Why does your computer send an ARP request before sending a packet to 192.168.1.30?
Ethernet frames are delivered by MAC address. ARP turns a known IP address on the same network into the MAC address of the card that owns it.
02Where is an ARP request sent?
The sender does not know the target's MAC yet, so it has to ask everyone. The switch copies a broadcast out of every port except the one it came in on.
03Which computers answer the request "Who has 192.168.1.30?"
Only the owner replies, and its reply is unicast: addressed straight to the sender's MAC, not broadcast.
04What does the ARP cache do?
Each entry lasts a while (usually minutes, depending on the operating system) and then expires, so pairs that have changed do not stick around.
05Why can an attacker on the same network pretend to be another computer using ARP?
ARP has no way to check who sent a reply. That is ARP spoofing; switches can defend against it with features such as Dynamic ARP Inspection.
Glossary
- MAC address
- The hardware address of a network card, six bytes written like 00:00:5e:00:53:30. Ethernet delivers frames by MAC address.
- IP address
- The address a computer uses at the network layer, like 192.168.1.30. It says where a packet should end up.
- ARP
- Address Resolution Protocol (RFC 826): finds the MAC address that belongs to an IP address on the local network.
- Broadcast
- A frame sent to ff:ff:ff:ff:ff:ff, which every device on the local network receives.
- Unicast
- A frame addressed to exactly one MAC address.
- ARP cache
- A computer's short-lived table of IP-to-MAC pairs it has learned recently.
- EtherType
- The two-byte type field in an Ethernet frame that says what is inside: 0x0806 for ARP, 0x0800 for IPv4.
- Gratuitous ARP
- An ARP message a host sends about its own address without being asked, to announce it (and others may spot a conflict).
Notes and sources
- The LAN 192.168.1.0/24 is a private range (RFC 1918); the MAC addresses come from the documentation block 00:00:5e:00:53:xx (RFC 9542, which replaced RFC 7042).
- How long a cache entry lives is up to the operating system; there is no single standard value. You can see your own cache with "arp -a" (or "ip neigh" on Linux).
- Gratuitous ARP: a host can announce its own pair unasked, with its own IP as the target, for example after it starts up or takes over an address. Others update their caches (and may spot an address conflict). Checking for a conflict before using an address is the ARP Probe of RFC 5227.
- ARP has no authentication: any host can send a reply claiming any IP, and others will believe it. That is ARP spoofing, used to sit in the middle of a conversation; switches defend with features such as Dynamic ARP Inspection.
- IPv6 does not use ARP. It does the same job with Neighbor Discovery (RFC 4861), using multicast instead of broadcast.
- RFC 826: An Ethernet Address Resolution Protocol
- RFC 5227: IPv4 Address Conflict Detection (ARP probes and announcements)
- RFC 9542: IANA considerations and IETF protocol usage for IEEE 802 parameters (documentation MACs; replaces RFC 7042)
- RFC 1918: Address allocation for private internets
- IANA: ARP parameters (opcodes, hardware types)
- IEEE 802.3: Ethernet
Quiz Unlocks after the last step.