How ARP Works: Understanding Address Resolution Protocol

ARP (Address Resolution Protocol) works by sending a broadcast message on a local network to find the MAC address that matches a known IP address. The device with that IP replies with its MAC address, allowing devices to communicate using hardware addresses.

Syntax

The basic ARP message format includes the following parts:

• Hardware Type: Type of hardware (usually Ethernet).
• Protocol Type: Type of protocol address (usually IPv4).
• Hardware Size: Length of hardware address (6 bytes for MAC).
• Protocol Size: Length of protocol address (4 bytes for IPv4).
• Opcode: Request (1) or Reply (2).
• Sender MAC & IP: Address of the sender.
• Target MAC & IP: Address of the target (MAC unknown in request).

c

struct arp_packet {
  uint16_t hardware_type;
  uint16_t protocol_type;
  uint8_t hardware_size;
  uint8_t protocol_size;
  uint16_t opcode; // 1=request, 2=reply
  uint8_t sender_mac[6];
  uint8_t sender_ip[4];
  uint8_t target_mac[6];
  uint8_t target_ip[4];
};

Example

This example shows how a device sends an ARP request and receives a reply to find the MAC address for a given IP.

python

import socket
import struct

# This example is conceptual and simplified

def create_arp_request(sender_mac, sender_ip, target_ip):
    # Build an ARP request packet (simplified)
    return f"ARP request from {sender_ip} asking for {target_ip}"

def receive_arp_reply():
    # Simulate receiving an ARP reply
    return "ARP reply: target IP 192.168.1.10 has MAC aa:bb:cc:dd:ee:ff"

# Device wants to find MAC for 192.168.1.10
sender_mac = "00:11:22:33:44:55"
sender_ip = "192.168.1.5"
target_ip = "192.168.1.10"

request = create_arp_request(sender_mac, sender_ip, target_ip)
print(request)

reply = receive_arp_reply()
print(reply)

Output

ARP request from 192.168.1.5 asking for 192.168.1.10
ARP reply: target IP 192.168.1.10 has MAC aa:bb:cc:dd:ee:ff

Common Pitfalls

Common mistakes when dealing with ARP include:

• Assuming ARP works across different networks; it only works within the same local network.
• Ignoring ARP cache, which stores recent IP-to-MAC mappings and can cause stale entries.
• Not handling ARP spoofing attacks, where false ARP replies can mislead devices.

Always verify ARP entries and use security measures to prevent spoofing.

Quick Reference

ARP Term	Description
ARP Request	Broadcast message asking for MAC of an IP address
ARP Reply	Unicast message responding with MAC address
MAC Address	Hardware address used to identify devices on a local network
IP Address	Logical address used to identify devices on a network
ARP Cache	Table storing recent IP-to-MAC mappings

Key Takeaways

ARP maps IP addresses to MAC addresses within a local network using broadcast requests and replies.

ARP only works inside the same local network segment, not across routers.

Devices keep an ARP cache to speed up address resolution and reduce network traffic.

Be aware of ARP spoofing risks and use security tools to protect your network.

Understanding ARP helps troubleshoot local network connectivity issues.