ARP
Address Resolution ProtocolARP is the last translation before the wire. A host knows the IP address it wants to reach on the local network, but the Ethernet card can only deliver to a MAC address. ARP asks the segment “who has this IP?” and caches the hardware address that answers.
ARP resolves a local IP address to the MAC address that owns it — one broadcast question, one cached answer.
Open the ARP lab →
“Who has this IP?” Broadcast the question, watch the switch flood, get one unicast answer, fill the cache.
How it works
The question is a broadcast because A doesn’t yet know who to ask; the answer is a unicast straight back. For an IP off the LAN, A resolves the gateway’s MAC instead.
What ARP does, step by step
If the IP→MAC pair is already known, the host skips straight to sending — no ARP traffic at all.
On a miss it floods “who has this IP?” to every host on the local segment at once.
Only the host holding that IP answers, unicast, with its hardware address.
The pair is cached with a short timeout, and frames flow directly until it expires.
In cybersecurity
ARP has no authentication whatsoever — a host believes any reply it hears, which makes spoofing the classic LAN attack.
An attacker sends forged replies claiming the gateway’s IP, so traffic detours through them.
Once in the path they can read, alter or drop traffic — only encryption above keeps it private.
Switches validate replies against DHCP-snooping data and drop the forged ones.
Unsolicited replies quietly overwrite good entries; static entries pin critical ones in place.
Poisoning a gateway entry with a dead MAC simply blackholes a host off the network.
ARP is link-local, so smaller VLANs shrink the blast radius of any spoofing attack.