What Is ARP?

The Address Resolution Protocol (ARP) is a critical Layer 2 protocol that bridges the gap between physical networking and logical networking. Its sole purpose is to map a known logical IPv4 address to an unknown physical MAC Address.

When a computer wants to send data to another device on the same local network, it knows the destination IP address (e.g., 192.168.1.50). However, network switches do not understand IP addresses; they route traffic based on MAC addresses. The sending computer must use ARP to ask the local network, "Who has this IP address, and what is your MAC address?"

How ARP Works: The Packet Flow

ARP operates using a simple Request and Reply mechanism.

1. The ARP Request (Broadcast)

If PC-A wants to ping PC-B (192.168.1.50), it first checks its internal ARP Cache to see if it already knows PC-B's MAC address. If the cache is empty, PC-A sends an ARP Request broadcast to the entire local network (VLAN). The message translates to: "Who has IP 192.168.1.50? Tell 192.168.1.10."

2. The ARP Reply (Unicast)

Every device on the local network receives this broadcast, but only PC-B replies. PC-B sends an ARP Reply directly back to PC-A (unicast) stating: "I have 192.168.1.50, and my MAC address is 00:1A:2B:3C:4D:5E."

3. The ARP Cache

PC-A receives the reply, saves the mapping in its local ARP cache for a few minutes to avoid spamming the network with broadcasts, and finally transmits the Ping packet.

ARP and the Default Gateway

What happens if PC-A wants to ping 8.8.8.8 on the internet? PC-A knows 8.8.8.8 is not on its local subnet. Therefore, it does not send an ARP Request for 8.8.8.8.

Instead, PC-A sends an ARP Request for the IP address of its Default Gateway (the local router). Once PC-A learns the router's MAC address, it sends the packet destined for 8.8.8.8 to the physical MAC address of the router.

Commands to View the ARP Table

You can view your computer's current ARP cache to see which IP addresses have been successfully resolved to MAC addresses.

Windows

Linux / macOS

Common ARP Problems and Troubleshooting

1. Stale ARP Entries

If you replace a network printer, the new printer might get the same IP address (192.168.1.100) but will definitely have a new hardware MAC address. Your PC might still hold the old MAC address in its ARP cache. When you try to print, the traffic goes to a dead MAC address, and the connection times out.

Troubleshooting: Clear the ARP cache. On Windows, run arp -d * from an Administrator command prompt. On Linux, run ip -s -s neigh flush all.

2. Duplicate IP Addresses

If two computers accidentally have the exact same IP Address, they will both respond to ARP Requests. The switch and the sending PC will become confused as the ARP cache rapidly flips back and forth between two different MAC addresses. This causes intermittent, severe packet loss.

Troubleshooting: If you suspect an IP conflict, check the ARP table. If the MAC address for the server keeps changing every few seconds, a rogue device has stolen the IP.

3. ARP Not Resolving (Incomplete)

If you ping a device on the same subnet and it fails, check your ARP table. If the entry for that IP shows as incomplete or missing, it means the ARP Request was sent, but no ARP Reply was received. This indicates a physical layer issue, an incorrect VLAN assignment, or a completely dead device.

Security Note: ARP Spoofing

ARP is a trusting protocol with no built-in authentication. A malicious device on the local network can broadcast fake ARP Replies, telling everyone, "I am the Default Gateway." All computers will update their ARP caches and blindly send their internet traffic to the attacker. This is called ARP Spoofing or ARP Poisoning (a Man-in-the-Middle attack). Enterprise switches combat this using security features like Dynamic ARP Inspection (DAI).

Quick Summary

• ARP resolves a known IP address to an unknown MAC address.
• It broadcasts a Request and waits for a unicast Reply.
• Computers cache ARP mappings temporarily to save bandwidth.
• If a computer needs to reach the internet, it ARPs for the Default Gateway's MAC address, not the internet IP.