ARP (Address Resolution Protocol)

What is ARP

ARP (Address Resolution Protocol) is a protocol used to resolve an IPv4 address into the corresponding MAC address on the same link. It is defined in RFC 826.

When sending an IP packet over Ethernet, the IP header contains the destination IP address, but delivering the frame actually requires the destination MAC address in the Ethernet frame. ARP is responsible for obtaining that MAC address by broadcasting a query, keyed on the IP address, within the same segment.

ARP Packet Format

An ARP packet is sent as the payload of an Ethernet frame and is identified by EtherType 0x0806. Because the hardware address (MAC address, 6 bytes) and protocol address (IPv4 address, 4 bytes) do not align to a 32-bit boundary, the latter part of the address fields spans across rows.

How ARP Works

Suppose R1 (192.168.0.1) wants to know the MAC address of R2 (192.168.0.2). Resolution proceeds as follows. Assume R3 (192.168.0.3) also exists on the same link. R1, R2, and R3 are all connected to switch SW via their Gi1 interfaces.

sequenceDiagram
    participant R1 as R1
192.168.0.1
    participant SW as SW
    participant R3 as R3
192.168.0.3
    participant R2 as R2
192.168.0.2

    Note over R1: MAC address for
192.168.0.2 is unresolved

    R1->>SW: ARP Request (1 packet)
Dst MAC: FF:FF:FF:FF:FF:FF
Target Protocol Address: 192.168.0.2
Operation: 1

    par SW floods it out all ports
        SW->>R3: ARP Request
    and
        SW->>R2: ARP Request
    end

    Note over R3: Target Protocol Address
doesn't match own IP, drop

    Note over R2: Target Protocol Address
matches own IP
    R2->>R1: ARP Reply (unicast)
Sender Hardware Address: R2's MAC
Operation: 2

    Note over R1: Record 192.168.0.2 and R2's
MAC address in the ARP cache

1. R1 sends an ARP Request with the destination MAC address set to FF:FF:FF:FF:FF:FF (broadcast). In the packet, the Target Hardware Address is 00:00:00:00:00:00, and the Target Protocol Address is set to R2’s IP address (192.168.0.2).
2. Every host on the same link receives this broadcast frame, but only R2, whose IP address matches the Target Protocol Address, responds. R3 discards the frame because the Target Protocol Address does not match its own IP address.
3. R2 sends an ARP Reply, with its own MAC address set as the Sender Hardware Address, back to R1 as a unicast (Operation = 2).
4. R1 receives the ARP Reply and records the mapping between R2’s IP address and MAC address in its own ARP cache.

Verification on Real Devices

We connected R1, R2, and R3 (Cisco IOS XE) as described above, ran ping 192.168.0.2 from R1, and verified ARP’s behavior using a packet capture and the ARP table on each router.

ARP Request Capture (R1 → Broadcast)

Ethernet II, Src: 52:54:00:ce:70:87, Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Type: ARP (0x0806)
Address Resolution Protocol (request)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (1)
    Sender MAC address: 52:54:00:ce:70:87
    Sender IP address: 192.168.0.1
    Target MAC address: 00:00:00:00:00:00
    Target IP address: 192.168.0.2

The destination MAC address is broadcast (ff:ff:ff:ff:ff:ff), the Target MAC Address is 00:00:00:00:00:00, and the Opcode is request (1) — confirming that R1 sent exactly what was described above.

ARP Reply Capture (R2 → Unicast to R1)

Ethernet II, Src: 52:54:00:3b:94:2b, Dst: 52:54:00:ce:70:87
    Type: ARP (0x0806)
Address Resolution Protocol (reply)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: reply (2)
    Sender MAC address: 52:54:00:3b:94:2b
    Sender IP address: 192.168.0.2
    Target MAC address: 52:54:00:ce:70:87
    Target IP address: 192.168.0.1

Only R2, whose Target Protocol Address matched its own IP address (192.168.0.2), sent an ARP Reply with Opcode reply (2) back to R1 as a unicast.

Comparing the ARP Table on Each Router

R1#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.0.1             -   5254.00ce.7087  ARPA   GigabitEthernet1
Internet  192.168.0.2            11   5254.003b.942b  ARPA   GigabitEthernet1

R2#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.0.1            11   5254.00ce.7087  ARPA   GigabitEthernet1
Internet  192.168.0.2             -   5254.003b.942b  ARPA   GigabitEthernet1

R3#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.0.3             -   5254.00d9.39cc  ARPA   GigabitEthernet1

The ARP table on R1 and R2 each contains their own entry (Age -, exempt from aging) plus an entry learned from the other side (Age 11 minutes elapsed). R3, on the other hand, received the ARP Request but was not the target of the Target Protocol Address, so its ARP table contains only its own entry. Since R3 never sent an ARP Reply, R1 and R2 never learn R3’s MAC address either.

ARP Cache (ARP Table)

Once an IP address has been resolved to a MAC address, the mapping is kept as an ARP cache (ARP table) on the host or router. This means an ARP Request no longer needs to be broadcast for every subsequent communication to the same destination.

Entries in the ARP cache have an expiration (aging time), and entries are automatically removed once that time has elapsed. This mechanism lets the cache keep up with changes such as a MAC address change (e.g. a replaced NIC) or a change to a host’s IP address. The default aging time varies by device/OS; for example, Cisco IOS routers default to 4 hours (14,400 seconds), which can be changed with the arp timeout command.

R1#show interfaces gigabitEthernet 1 | inc ARP Timeout
  ARP type: ARPA, ARP Timeout 04:00:00
R1#

Gratuitous ARP

Gratuitous ARP is an ARP Request sent with both the sender’s and target’s protocol addresses set to the sender’s own IP address. Rather than requesting a response the way ordinary ARP does, it is used for purposes such as the following.

• Duplicate IP address detection: at startup, a host sends a Gratuitous ARP for its own IP address; if it gets a reply, it can conclude that a device already using the same address exists.
• ARP cache update notification: it informs other hosts so that they reflect/update the mapping between the sender’s IP address and MAC address in their ARP cache. It is used to immediately update the ARP caches of surrounding hosts when the device responsible for a virtual IP address changes over during a failover (e.g. VRRP/HSRP).

Gratuitous ARP Capture

Ethernet II, Src: 52:54:00:ce:70:87 (52:54:00:ce:70:87), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: 52:54:00:ce:70:87 (52:54:00:ce:70:87)
    Type: ARP (0x0806)
    [Stream index: 0]
    Padding: 000000000000000000000000000000000000
Address Resolution Protocol (reply/gratuitous ARP)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: reply (2)
    [Is gratuitous: True]
    Sender MAC address: 52:54:00:ce:70:87 (52:54:00:ce:70:87)
    Sender IP address: 192.168.0.1
    Target MAC address: Broadcast (ff:ff:ff:ff:ff:ff)
    Target IP address: 192.168.0.1

The defining characteristic of Gratuitous ARP is that the Sender IP Address and Target IP Address are both the sender R1’s own IP address (192.168.0.1); Wireshark detects this and shows [Is gratuitous: True]. In this capture the Opcode is reply (2) and the destination MAC address is broadcast (ff:ff:ff:ff:ff:ff), but some implementations send it with Opcode request (1) instead — either way, what they have in common is that Gratuitous ARP is identified by whether the Sender Protocol Address and Target Protocol Address match.

Proxy ARP

Proxy ARP is a feature where a router replies with its own MAC address to an ARP Request that is not actually addressed to it. This lets the sending host communicate as if the destination were on the same segment, even though it is actually on a different one.

While this can simplify routing design in some configurations, it has the side effect of allowing unintended cross-segment communication, so today it is generally disabled unless explicitly needed. Note that Proxy ARP is enabled by default on Cisco IOS routers, and can be disabled per interface with the no ip proxy-arp command.

Reverse ARP (RARP)

Reverse ARP (RARP) is a protocol that does the opposite of ARP: it resolves an IP address from a MAC address. It was used by devices such as diskless workstations that do not yet hold their own IP address at boot time, allowing them to query a RARP server based on their own known MAC address and obtain an assigned IP address.

Security Note: ARP Spoofing

ARP has no mechanism for authenticating the sender, so any host can send an ARP Reply even without having received a Request. Exploiting this, an attack that sends forged ARP Replies to maliciously rewrite another host’s ARP cache is called ARP spoofing (ARP poisoning). An attacker can redirect traffic that was meant for another device to themselves, enabling eavesdropping or a man-in-the-middle (MITM) attack.

Countermeasures include a switch’s Dynamic ARP Inspection (DAI) feature, and validation using a binding table in conjunction with DHCP Snooping.

References

• RFC 826 - An Ethernet Address Resolution Protocol

Related Articles

• IPv4 Packet Header Structure
• IPv4 Addresses
• IPv4 Subnet Mask Calculator
• ARP (Address Resolution Protocol)
• What is ICMP (Internet Control Message Protocol)
• ICMP Echo Request/Reply (ping)
• ICMP Time Exceeded (traceroute)
• ICMP Destination Unreachable