ARP, the Address Resolution Protocol, is the mechanism that finds the MAC address belonging to an IPv4 address on the same local network segment. In networking and address configuration, it closes the gap between the logical address that a host received from DHCP or static setup and the physical hardware address that Ethernet and Wi-Fi need to deliver a frame.
ARP is defined in RFC 826 and operates directly over the link layer with EtherType 0x0806. Every IPv4 host and router runs it continuously, usually without any visible configuration, and keeps the results in a short-lived ARP cache.
How ARP resolves an IPv4 address
Resolution starts when a host needs to send an IPv4 packet to a next hop on the local subnet. The host first compares the destination with its own address and subnet mask: if the destination is local, the next hop is the destination itself; otherwise it is the default gateway. ARP always resolves the next hop, never a remote host beyond a router.
If the cache has no entry, the host sends an ARP request as a broadcast to ff:ff:ff:ff:ff:ff asking which device owns the target IP. Only the owner replies, with a unicast ARP reply carrying its MAC address. Both sides typically store the mapping, and the waiting packet is then sent in a normal Ethernet frame.
The following table lists the fields of an ARP packet for Ethernet and IPv4, which total 28 bytes.
| Field | Size | Typical value |
|---|---|---|
| Hardware type | 2 bytes | 1 for Ethernet |
| Protocol type | 2 bytes | 0x0800 for IPv4 |
| Address lengths | 1 byte each | 6 for MAC, 4 for IPv4 |
| Operation | 2 bytes | 1 for request, 2 for reply |
| Sender MAC and IP | 6 and 4 bytes | Address of the sending device |
| Target MAC and IP | 6 and 4 bytes | Zero MAC in a request, known in a reply |
The ARP cache and its timers
Each host keeps an ARP cache, also called the neighbor table, so that it does not broadcast before every packet. Entries expire after a period that depends on the operating system and device, which is a balance between fresh data and broadcast traffic.
| Platform | Typical entry lifetime | Notes |
|---|---|---|
| Linux | About 15 to 45 seconds reachable, then revalidated | Neighbor states such as REACHABLE and STALE |
| Windows | About 15 to 45 seconds, randomized | Based on a base reachable time of 30 seconds |
| Enterprise routers | Often 4 hours | Long timers reduce control-plane load |
| Static entries | Never expire | Configured manually by an administrator |
A mismatch between timers causes a known problem. When a router keeps an entry for 4 hours but the switch forgets the MAC address after 5 minutes, traffic toward a quiet host may be flooded to every port of the VLAN until the host speaks again. Aligning the timers removes this unicast flooding.
Special forms of ARP
Beyond the basic request and reply, several variants of ARP serve configuration and redundancy tasks. They reuse the same packet format with different sender and target values.
| Variant | How it works | Purpose |
|---|---|---|
| Gratuitous ARP | Host announces its own IP and MAC unprompted | Updates neighbor caches after a change or failover |
| ARP probe | Request with sender IP set to 0.0.0.0 | Detects address conflicts before using an IP |
| Proxy ARP | Router answers on behalf of a remote host | Supports hosts with incorrect subnet masks |
| Reverse ARP | Host asks for its IP using its MAC | Obsolete, replaced by BOOTP and DHCP |
| Inverse ARP | Finds an IP for a known link identifier | Legacy Frame Relay and ATM networks |
Gratuitous ARP is essential for high availability. When a virtual IP moves between two firewalls or load balancers, the new owner sends gratuitous ARP so that every neighbor updates its cache at once, rather than waiting for old entries to expire.
ARP compared with related address configuration mechanisms
ARP does not assign addresses; it only resolves addresses that already exist. It works alongside DHCP and, in IPv6 networks, is replaced entirely by a different protocol.
| Mechanism | Question it answers | IP version |
|---|---|---|
| ARP | Which MAC address owns this local IP | IPv4 |
| NDP | Neighbor and router discovery, address resolution | IPv6 |
| DHCP | Which IP address and settings should this host use | IPv4 and IPv6 |
| SLAAC | How can a host build its own IPv6 address | IPv6 |
In IPv6, the Neighbor Discovery Protocol uses ICMPv6 multicast to solicited-node addresses instead of broadcast. This reduces the load on hosts that are not involved, which is one reason why IPv6 has no ARP at all.
Security risks and common ARP problems
ARP has no authentication, so any device on the segment can claim any IP address. Hosts accept unsolicited replies and overwrite cache entries, which makes ARP spoofing, also called ARP poisoning, a classic man-in-the-middle technique on local networks.
- ARP spoofing redirects traffic by announcing the gateway IP with an attacker MAC; switches mitigate it with Dynamic ARP Inspection based on DHCP snooping data.
- Duplicate IP addresses appear as flapping cache entries and intermittent connectivity; ARP probes and logs reveal the conflicting MAC.
- Incomplete entries mean requests receive no reply, usually because the target is down, in another VLAN or blocked by a host firewall.
- ARP storms on large flat networks waste bandwidth; smaller subnets and segmentation reduce the broadcast domain.
- Stale caches after hardware replacement keep sending to the old MAC until timers expire or a gratuitous ARP is sent.
The commands ip neigh on Linux and arp -a on Windows show the cache and are the first diagnostic step whenever a host on the same subnet answers to some devices but not to others.
Stripped to the essentials
Every device on a local network has two kinds of address. The IP address works like a name on a list. The hardware address works like the exact desk where the device sits. To hand over a package, the sender needs the desk, not only the name.
ARP is the act of asking the whole room who owns a given name. The right device answers with its desk location. The sender writes the answer down for a short time. That way, it does not have to ask again for every package.
Where it is applied
A small company runs two firewalls in an active-passive pair that share the virtual gateway address 192.168.10.1. Office computers send all internet traffic to that address, and their ARP caches map it to the MAC address of the active firewall.
During planned maintenance, the active firewall is shut down and the passive unit takes over the virtual IP. It immediately sends gratuitous ARP announcements, and every workstation, printer and switch updates its cache within a second. Users notice only a brief pause. In an earlier setup without gratuitous ARP, the same switchover had caused several minutes of outage while hosts waited for old entries to expire, which is why failover testing now always includes checking the ARP tables.