How Address Resolution Protocol Works, Examples and Security Risks

Address Resolution Protocol, commonly known as ARP, is a networking protocol used to resolve an IPv4 address into a link-layer address, typically a MAC address, on a local network.

For example, a laptop may know that a printer uses:

IPv4 address: 192.168.1.50

However, to send an Ethernet frame directly to that printer, the laptop also needs its MAC address.

ARP provides the missing information by allowing the laptop to ask which device is associated with that IPv4 address.

The process is straightforward:

Known IPv4 address → ARP request → MAC address discovered → Local communication
Although ARP normally operates automatically, problems with address resolution can affect local connectivity, cause intermittent failures or introduce security risks.

Although ARP normally operates automatically, problems with address resolution can affect local connectivity, cause intermittent failures or introduce security risks.

Therefore, understanding ARP is particularly useful when troubleshooting networks, investigating duplicate IP addresses and recognising suspicious local-network activity.

For a broader comparison of the two addressing layers, see IPv4 Address vs MAC Address.

What Is Address Resolution Protocol (ARP)?

ARP is a protocol that allows devices to discover the link-layer address associated with a known network-layer address.

In a typical IPv4 Ethernet network, this means mapping:

IPv4 address → MAC address

For example:

192.168.1.50 → 00:1A:2B:3C:4D:5E

The device can then use the MAC address when constructing an Ethernet frame for local delivery.

ARP was originally specified in RFC 826, which describes how network protocol addresses can be mapped to Ethernet hardware addresses.

However, ARP does not assign IPv4 addresses, resolve domain names or determine the complete route across the Internet.

Its primary role is narrower:

ARP helps a device identify the link-layer destination for an IPv4 next hop on the local network.

Why Does IPv4 Need ARP?

IPv4 and Ethernet addressing operate at different network layers.

Suppose a laptop wants to contact a printer on the same local Ethernet network.

The laptop already knows the printer's IPv4 address. However, Ethernet forwarding requires the frame's destination MAC address.

Therefore, the laptop uses ARP to discover that address before sending the frame.

This is the relationship between logical IP addressing and local-link delivery.

How Does ARP Work Step by Step?

Consider two devices on the same local network.

Laptop

IPv4: 192.168.1.20
MAC: 00:11:22:33:44:55

Printer

IPv4: 192.168.1.50
MAC: 66:77:88:99:AA:BB

Both devices use the subnet:

192.168.1.0/24

The laptop wants to communicate with the printer.

Step 1: Check the ARP Cache

Before sending a new ARP request, the laptop checks whether it already knows the MAC address associated with:

192.168.1.50

If a usable mapping exists, it can use that information for local delivery.

Otherwise, the laptop must resolve the address.

Step 2: Broadcast an ARP Request

The laptop sends an ARP request to the local broadcast domain.

Conceptually, the request asks:

Who has 192.168.1.50? Tell 192.168.1.20.

The request is normally carried in a broadcast Ethernet frame so that devices on the local network can receive it.

Step 3: The Printer Sends an ARP Reply

The printer recognises that the requested IPv4 address matches its own address.

It responds with its MAC address:

66:77:88:99:AA:BB

The reply is normally sent directly to the requesting device.

Step 4: Store the IP-to-MAC Mapping

The laptop stores the resolved address in its neighbour or ARP cache.

For example:

192.168.1.50 → 66:77:88:99:AA:BB

The entry can be reused while it remains valid.

Step 5: Send the Ethernet Frame

The laptop can now construct the frame:

Source MAC: 00:11:22:33:44:55

Destination MAC: 66:77:88:99:AA:BB

Inside that frame, the IPv4 packet contains:

Source IPv4: 192.168.1.20

Destination IPv4: 192.168.1.50

Therefore, ARP does not replace IPv4 addressing.

Instead, it provides the link-layer information needed to deliver the IPv4 packet locally.

ARP Request vs ARP Reply

Although this is the normal request-and-reply model, ARP can also be used for unsolicited announcements and other specialised behaviour.

Therefore, not every ARP packet observed in a packet capture indicates a new connection attempt.

Practical Example: ARP and the Default Gateway

ARP behaves differently when the destination is outside the local subnet.

Suppose a laptop has:

IPv4: 192.168.1.20

Subnet: 192.168.1.0/24

Default gateway: 192.168.1.1

The laptop wants to contact:

8.8.8.8

Because this destination is remote, the laptop checks its routing table.

Assuming the default route applies, it selects:

192.168.1.1

as the next hop.

The laptop then uses ARP to resolve the gateway's MAC address, not the MAC address of 8.8.8.8.

The flow becomes:

Destination IPv4: 8.8.8.8
↓
Routing table selects gateway
↓
Next-hop IPv4: 192.168.1.1
↓
ARP resolves gateway MAC
↓
Ethernet frame sent to router
↓
Router forwards the IP packet

This is an important distinction.

ARP does not discover the MAC address of a remote Internet server. It normally resolves a directly reachable IPv4 next hop.

For more information, see What Is a Default Gateway?.

What Is an ARP Table or ARP Cache?

An ARP table stores IPv4-to-MAC address mappings that a device can use for local communication.

For example:

The table helps avoid repeating address resolution every time a device sends traffic.

Dynamic ARP Entries

Dynamic entries are learned through network communication.

They are normally managed by the operating system and can expire, be refreshed or be replaced.

For example, a printer may be replaced with another device using the same IPv4 address but a different MAC address.

The old mapping must eventually be updated.

Static ARP Entries

Static entries are configured by an administrator.

They may be useful in specialised environments where a particular mapping must be maintained.

However, static ARP entries require ongoing maintenance.

If the hardware or network design changes without updating the entry, connectivity can fail.

Therefore, static ARP configuration should not be treated as a universal solution to ARP security problems.

How to Check the ARP Table on Windows

Windows provides the arp command for inspecting its ARP cache.

Open Command Prompt and enter:

arp -a

Example output:

Interface: 192.168.1.20

Internet Address    Physical Address      Type
192.168.1.1         aa-bb-cc-dd-ee-01     dynamic
192.168.1.50        66-77-88-99-aa-bb     dynamic
192.168.1.80        aa-bb-cc-dd-ee-03     dynamic

The output contains:

• Internet Address: IPv4 address
• Physical Address: MAC address
• Type: Whether the mapping is dynamic or static

To inspect one IPv4 address:

arp -a 192.168.1.50

Windows can maintain neighbour information for multiple network interfaces. Therefore, inspect the correct adapter when a device has Ethernet, Wi-Fi, VPN or virtual interfaces.

An address missing from the ARP table does not automatically indicate a network failure. The device may simply not have attempted to communicate with that neighbour recently.

How to Check ARP on Linux

Linux provides neighbour-table commands through the ip utility.

To display IPv4 neighbour entries:

ip -4 neigh show

Example:

192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:01 REACHABLE
192.168.1.50 dev eth0 lladdr 66:77:88:99:aa:bb STALE

The output provides the resolved MAC address, interface and neighbour state.

Common states include:

Importantly, STALE is not automatically an error.

It is part of normal neighbour-cache management.

A FAILED entry, however, can be useful evidence when investigating communication problems.

How to Check ARP on macOS

On macOS, Terminal provides the arp utility.

To display the ARP table:

arp -an

To inspect a particular local IPv4 address:

arp -n 192.168.1.50

The output can help identify which MAC address the system currently associates with the specified neighbour.

However, ARP information should be compared with network configuration and device records before drawing conclusions.

How to Troubleshoot ARP Problems

ARP-related failures can resemble other connectivity problems.

For example:

• a printer becomes unreachable,
• a local server stops responding,
• communication works intermittently,
• a gateway appears unreachable,
• or an IPv4 address suddenly maps to a different MAC address.

However, these symptoms do not automatically prove ARP is the root cause.

The following process helps narrow the investigation.

Step 1: Check the IPv4 Configuration

Verify:

• IPv4 address
• subnet mask
• default gateway
• active network interface
• VLAN or network segment
• DHCP or static assignment

On Windows:

ipconfig /all

On Linux:

ip -4 addr
ip route

First confirm that the source and destination addresses are expected to communicate on the same local link.

Step 2: Check the ARP Entry

Inspect the suspected destination or gateway.

For example:

arp -a 192.168.1.50

Compare the displayed MAC address against the device's actual interface information or authorised network inventory.

A mismatch may be significant, but it must be interpreted in context.

Step 3: Confirm the Device and Network Segment

Check whether the destination is:

• connected to the expected VLAN,
• using the expected address,
• connected through the correct switch port,
• or using a virtual or redundant interface.

A device in another broadcast domain may not receive the ARP request even if its IPv4 address appears to belong to the expected subnet.

Step 4: Review Network Events

Check for recent changes such as:

• equipment replacement,
• virtual machine migration,
• DHCP changes,
• interface failover,
• gateway redundancy events,
• VLAN reconfiguration,
• or duplicate IPv4 assignments.

The timeline often helps explain why an ARP mapping changed.

Step 5: Verify the Actual Service

After identifying and correcting the cause, test the service that originally failed.

For example, if the incident affected a printer, confirm that users can print again.

A successful ping may provide useful evidence, but an unsuccessful ping does not necessarily prove ARP failure because ICMP responses may be restricted.

Practical Example: Stale ARP Entry After Device Replacement

Suppose an office printer originally used:

IPv4: 192.168.1.80

MAC: AA:AA:AA:AA:AA:01

The printer is replaced.

The new printer uses the same IPv4 address but a different MAC:

BB:BB:BB:BB:BB:02

However, a computer still has the old mapping:

192.168.1.80 → AA:AA:AA:AA:AA:01

As a result, traffic may initially be directed toward the old MAC address.

This can cause temporary connectivity problems until the mapping is refreshed.

The underlying issue is:

Old address mapping → Hardware changed → Cached information no longer matches

Possible corrective actions include:

1. Confirm the new printer's actual IPv4 and MAC addresses.
2. Review the computer's ARP entry.
3. Allow or trigger normal neighbour re-resolution.
4. Clear a specific stale entry if necessary and appropriate.
5. Retest printing and update the network inventory.

Clearing the ARP cache can help with stale mappings, but it should not be used as a substitute for identifying the underlying cause.

On production systems, changing neighbour entries may briefly interrupt active connections, so administrators should assess the impact before making changes.

Practical Example: ARP and Duplicate IPv4 Addresses

Consider two devices configured with the same address:

Device A

IPv4: 192.168.1.90
MAC: AA:AA:AA:AA:AA:01

Device B

IPv4: 192.168.1.90
MAC: BB:BB:BB:BB:BB:02

Both devices are connected to the same local broadcast domain.

When another computer asks:

Who has 192.168.1.90?

both devices may respond.

Different computers may then associate the IPv4 address with different MAC addresses.

Connectivity can become inconsistent because traffic is not reliably reaching the intended device.

RFC 5227 describes ARP-based mechanisms for detecting IPv4 address conflicts.

However, a changing ARP mapping is not sufficient proof of duplicate addressing by itself.

For example, legitimate high-availability systems may move an IP address between interfaces during failover.

Therefore, administrators should compare ARP observations with DHCP records, configured addresses and network events.

For the complete troubleshooting process, see How to Investigate an IP Address Conflict.

What Is Gratuitous ARP?

Gratuitous ARP refers to ARP messages sent without an ordinary address-resolution request from another device.

Such messages can announce or check an address association.

They may be used during:

• address conflict detection,
• device startup,
• interface changes,
• gateway failover,
• IP address migration,
• and network redundancy events.

For example, when a virtual IP address moves from one router to another, an ARP announcement may help neighbouring devices learn the updated address association.

Therefore, unsolicited ARP traffic is not automatically malicious.

The context and expected network behaviour matter.

What Is ARP Spoofing?

ARP spoofing occurs when a device sends misleading ARP information so that another system associates an IPv4 address with an incorrect MAC address.

Consider a normal network:

Laptop → Router → Internet

The laptop's ARP cache contains:

192.168.1.1 → Router MAC

Now suppose an attacker-controlled device on the same local network sends false ARP information claiming that the gateway's IPv4 address corresponds to the attacker's MAC address.

The victim may then associate:

192.168.1.1 → Attacker MAC

As a result, traffic intended for the router may be sent to the attacker-controlled interface instead.

Possible consequences include:

• traffic redirection,
• service interruption,
• interception attempts,
• or man-in-the-middle positioning.

However, the impact depends on the network environment and other security protections.

Encrypted connections, endpoint protections, network access controls and switch security features may reduce what an attacker can achieve.

ARP spoofing does not automatically mean the attacker can read all encrypted traffic.

ARP Spoofing vs ARP Poisoning

These terms are closely related.

In practice, the terms are often used interchangeably.

However, the distinction between sending false information and changing another device's mapping is useful when investigating an incident.

For additional operational context, LARUS provides a guide to common ARP and IP addressing issues, including spoofing, cache poisoning and configuration problems.

Why Is ARP Vulnerable to Spoofing?

ARP was designed to resolve local network addresses, not provide strong authentication of every address claim.

Consequently, devices may receive ARP information that is incorrect, misleading or intentionally forged.

This creates a trust problem:

A device receives an IP-to-MAC claim

but:

The ARP message alone does not establish that the sender is authorised to represent that IP address.

This is why network-level protections are important on shared local network segments.

However, ARP spoofing is primarily a local-link issue.

An ordinary attacker elsewhere on the public Internet cannot simply broadcast ARP messages directly into an unrelated private Ethernet network.

The attacker generally needs a position within the affected Layer 2 environment or another mechanism that provides equivalent local-network access.

How to Prevent ARP Spoofing and Poisoning

ARP security usually requires a combination of controls rather than a single setting.

Use Dynamic ARP Inspection

Dynamic ARP Inspection, or DAI, is a security feature available on certain managed switches.

It can inspect ARP messages arriving on untrusted ports and compare their IP-to-MAC information with authorised bindings.

If an ARP packet fails validation, the switch can discard it.

On supported switches, these bindings are often derived from DHCP snooping information.

However, devices using static IPv4 configurations may require appropriately configured ARP access control lists or other authorised binding mechanisms.

DAI must therefore be designed carefully rather than enabled without considering how addresses are assigned.

Use DHCP Snooping Where Appropriate

DHCP snooping helps network switches distinguish trusted DHCP infrastructure from untrusted client-facing ports.

It can also build binding information that Dynamic ARP Inspection uses for validation.

However, DHCP snooping does not replace every other ARP protection mechanism.

Its effectiveness depends on the supported switch, network configuration and binding accuracy.

Segment Local Networks

VLANs and network segmentation can reduce the number of systems sharing the same broadcast domain.

As a result, a compromise affecting one local segment may have a smaller exposure area than a completely flat network.

Segmentation should also be combined with appropriate access controls.

Monitor Unexpected Mapping Changes

Administrators can monitor:

• repeated changes in gateway MAC mappings,
• unusual ARP announcements,
• conflicting IP-to-MAC associations,
• unexpected devices,
• and security events from managed switches.

However, expected failover and virtual networking behaviour should be documented to avoid treating legitimate changes as attacks.

Maintain Accurate IP Address Records

Consistent IP allocation and device inventory records make suspicious mappings easier to investigate.

For example, an organisation can compare the observed address mapping against:

• DHCP lease information,
• reservations,
• static assignments,
• switch-port records,
• and expected device configurations.

The role of address allocation is explained in i.LEASE's guide to how DHCP manages IP allocation.

For broader inventory and lifecycle management, see LARUS.Foundation's IP Address Management (IPAM) guide.

ARP Security Controls Comparison

The most effective approach depends on network size, equipment capabilities and security requirements.

Importantly, accurate addressing records and ARP security are complementary, not interchangeable.

ARP vs DNS vs DHCP

ARP, DNS and DHCP are often confused because they all deal with addressing information.

However, they perform different functions.

For example, when a laptop opens a website:

1. DNS may resolve the website's domain name.
2. The operating system checks which route should be used.
3. ARP may resolve the local next-hop MAC address.
4. The packet is forwarded toward its destination.

DHCP may have supplied the laptop's IPv4 configuration earlier.

Therefore, these protocols support different stages of network communication.

Does IPv6 Use ARP?

No. IPv6 does not use ARP for ordinary link-layer address resolution.

Instead, IPv6 uses Neighbor Discovery, defined in RFC 4861, which relies on ICMPv6 messages.

Conceptually:

IPv4

IPv4 address → ARP → MAC address

IPv6

IPv6 address → Neighbor Discovery → Link-layer address

IPv6 Neighbor Discovery also supports functions beyond address resolution, including router discovery and neighbour reachability detection.

Therefore, ARP should be understood primarily as part of conventional IPv4 networking.

Practical ARP Troubleshooting Checklist

When investigating a possible ARP problem:

1. Identify the affected source and destination.
2. Confirm whether the destination is local or routed.
3. Check IPv4 addresses, subnet masks and gateways.
4. Inspect the ARP or neighbour table on the correct interface.
5. Compare mappings with authorised device records.
6. Check DHCP leases and static assignments.
7. Confirm VLAN and switch-port connectivity.
8. Review recent equipment changes or failover events.
9. Investigate unexpected ARP replies or mapping changes.
10. Check switch security logs if available.
11. Correct the confirmed root cause.
12. Verify the affected service and document the result.

Avoid clearing caches, changing static entries or disabling security controls without understanding the likely effect on active users.

The goal is not simply to make an ARP entry disappear.

It is to establish why the mapping is incorrect, missing or unexpected.

Conclusion

Address Resolution Protocol provides the information IPv4 devices need to deliver traffic across local Ethernet-style networks.

Its basic function is:

Known IPv4 address → ARP resolution → MAC address → Local frame delivery

However, ARP also has practical implications for troubleshooting and cybersecurity.

Stale mappings, duplicate addresses, VLAN problems and incorrect configurations can disrupt normal communication. Meanwhile, misleading ARP information can create traffic-redirection and local-network security risks.

Therefore, maintaining reliable local communication requires more than knowing how an ARP request works.

Administrators should understand how mappings are learned, how to inspect them, when they may change legitimately and which controls can detect or restrict unauthorised changes.

Ultimately, ARP is a small protocol with an important responsibility: connecting IPv4 routing decisions to the actual next-hop delivery mechanism on a local network.

Frequently Asked Questions

1. What is ARP in simple terms?

ARP stands for Address Resolution Protocol. It helps devices find the MAC address associated with an IPv4 address on a local network.

2. What is the main purpose of ARP?

Its main purpose is to provide link-layer address information needed for local delivery of IPv4 traffic.

3. How does ARP work?

A device checks its cache for an IPv4-to-MAC mapping. If the mapping is unavailable, it typically broadcasts an ARP request. The relevant device replies with its MAC address, which the requester can store and use.

4. What is an ARP request?

An ARP request asks which device is associated with a particular IPv4 address.

5. What is an ARP reply?

An ARP reply provides address information, normally identifying the MAC address associated with the requested IPv4 address.

6. What is an ARP table?

An ARP table stores IPv4-to-MAC address mappings used for local network communication.

7. How do I check ARP on Windows?

Open Command Prompt and run:

arp -a

This displays the available ARP cache entries.

8. How do I check ARP on Linux?

Run:

ip -4 neigh show

This displays IPv4 neighbour-table information.

9. Can ARP work across routers?

Ordinary ARP broadcasts are limited to their local network segment. When a destination is remote, the sender usually resolves the MAC address of the next-hop router rather than the remote destination.

10. What is ARP spoofing?

ARP spoofing occurs when misleading ARP information causes devices to associate an IPv4 address with an incorrect MAC address.

11. Is ARP poisoning the same as ARP spoofing?

They are closely related. ARP spoofing describes false ARP information, while ARP poisoning describes the resulting incorrect address mapping in a device's cache.

12. Can ARP spoofing happen over the Internet?

Ordinary ARP spoofing requires access to the relevant local network environment. ARP broadcasts are not normally forwarded across unrelated Internet networks.

13. What is gratuitous ARP?

Gratuitous ARP refers to unsolicited ARP messages used for purposes such as address announcements, conflict detection or updating neighbouring devices after network changes.

14. Does clearing the ARP cache fix connectivity problems?

It can help when a stale mapping is causing a problem, but it does not fix underlying address conflicts, incorrect network configuration or malicious activity.

15. Can ARP detect an IP address conflict?

ARP-based probing and announcements can help detect IPv4 address conflicts. RFC 5227 defines mechanisms for this purpose.

16. Does IPv6 use ARP?

No. IPv6 uses Neighbor Discovery based on ICMPv6 instead.

References

1. RFC 826 — An Ethernet Address Resolution Protocolhttps://www.rfc-editor.org/rfc/rfc826
2. RFC 5227 — IPv4 Address Conflict Detectionhttps://www.rfc-editor.org/rfc/rfc5227
3. RFC 4861 — Neighbor Discovery for IP Version 6 (IPv6)https://www.rfc-editor.org/rfc/rfc4861
4. Microsoft Learn — ARP Command Referencehttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/arp
5. Cisco — Dynamic ARP Inspection Configuration Guidehttps://www.cisco.com/c/en/us/td/docs/switches/lan/c9000/sec-crypto/fhs-sisf/fhs-and-sisf-configuration-guide/dynamic-arp-inspection.html
6. Linux Manual Pages — ip-neighbourhttps://man7.org/linux/man-pages/man8/ip-neighbour.8.html