https://network-switch.com/pages/about-us
Introduction
Even in 2026, ARP (Address Resolution Protocol) is still quietly doing a lot of work behind the scenes in IPv4 networks.
- IPv4 hasn't disappeared
- LANs are still full of Ethernet segments
- Every IPv4 packet still has to be delivered over a Layer 2 technology like Ethernet
To do that, devices must constantly answer one question:
"Given an IPv4 address, what MAC address should I send frames to on this LAN?"
That's exactly what ARP does.
In this article we'll cover:
- What ARP actually is and how it works
- Dynamic vs static ARP entries
- ARP attacks and modern protections (DAI, "ARP inspection")
- How IPv6 replaces ARP with NDP (Neighbor Discovery Protocol)
- Real-world troubleshooting examples using ARP tables and packet captures
ARP Fundamentals
What is ARP?
Address Resolution Protocol (ARP) is an IPv4 protocol that maps IP addresses to MAC addresses on a local network segment.
Where ARP actually runs:
- Hosts (PCs, servers, phones, IoT devices)
- Routers and Layer 3 switches (on their L3 interfaces)
What ARP does not run on:
- A pure Layer 2 switch doesn't speak ARP in the protocol sense; it just forwards Ethernet frames based on MAC/VLAN tables. The switch doesn't care about IP headers.
The purpose of ARP:
- IP routing decides "which next-hop IPv4 address" to send to.
- ARP answers "which MAC address on this LAN corresponds to that IPv4 address?"
- Once the MAC is known, the device can encapsulate the IP packet into an Ethernet frame and send it.
IP vs MAC: Why We Need ARP
- IPv4 address (L3): Logical address used by routers to forward packets across networks (e.g. 192.168.10.25).
- MAC address (L2): Physical or link-layer address used to deliver frames within a single broadcast domain (e.g. 00:11:22:33:44:55).
To send data:
- The sender needs to know: Where to send the packet at IP level (gateway or destination IP). What MAC to use for the next hop on the local link.
ARP is the "glue" between these layers in IPv4 networks.
ARP Cache / ARP Table
Every ARP-speaking device keeps a local table of IPv4 → MAC mappings, typically called:
- ARP cache / ARP table
- Neighbor cache (in some OSes)
It stores:
- IPv4 address
- MAC address
- Entry type (dynamic or static)
- State/age (how long since it was last used or learned)
Examples:
- On hosts: Windows: arp -a Linux: ip neigh or arp -n macOS: arp -a
- On routers / L3 switches (syntax varies by vendor): show arp display arp
These tables are key tools for both normal operation and troubleshooting.
Types of ARP (From an Operational Perspective)
Strictly speaking, ARP is one protocol, but operationally we often talk about:
- Dynamic ARP entries
- Static ARP entries
- Other variations like gratuitous ARP and proxy ARP
Dynamic ARP Entries
Dynamic ARP entries are:
- Learned automatically when a device sends or receives ARP Requests/Replies.
- Created in the ARP cache without manual configuration.
- Subject to aging: They time out if not used or refreshed.
Typical dynamic ARP behavior:
- Device needs to send to IPv4 address X on its local subnet.
- It checks its ARP cache: If mapping exists → use cached MAC. If not → send ARP Request (broadcast) asking "Who has IP X?"
- The owner of IP X replies with ARP Reply: "IP X is at MAC Y".
- The sender stores X → Y in its ARP cache for future traffic.
This automatic learning is what makes most IPv4 LAN communication "just work" without manual IP-MAC configuration.
Static ARP Entries
Static ARP entries are manually configured IP-MAC mappings.
Characteristics:
- They do not age out.
- They are not overwritten by dynamic ARP entries.
- They are often stored in configuration and persist across reboots.
Typical uses:
- Critical gateways and devices in small, highly controlled networks.
- Hardening specific host-gateway communication against ARP spoofing in small environments.
- Special scenarios where dynamic learning is undesirable.
Limitations:
- Manual management is labor-intensive.
- Not practical for hundreds or thousands of hosts.
- If MAC changes (NIC replaced, VM moved), you must update the static ARP entry.
Gratuitous ARP, Proxy ARP, and Others (Brief Overview)
A few other ARP-related behaviors are useful to know:
- Gratuitous ARP: A device sends an ARP request or reply about its own IP, unsolicited: For example, sending "192.168.1.1 is at MAC AA:BB:CC..." to update peers' ARP caches. Used in: Failover (VRRP/HSRP takeover). Duplicate IP detection.
- For example, sending "192.168.1.1 is at MAC AA:BB:CC..." to update peers' ARP caches.
- Used in: Failover (VRRP/HSRP takeover). Duplicate IP detection.
- Proxy ARP: A router answers ARP Requests for an IP that's not on the local subnet, promising to forward traffic on. Used for certain legacy designs or when hiding network complexity.
You don't need to deeply understand these to grasp ARP basics, but they're common in more advanced scenarios.
How ARP Works - Step-by-Step
Normal ARP Request/Reply Workflow (IPv4)
Consider two hosts on the same network 192.168.10.0/24:
- Host A: 192.168.10.10, MAC AA:AA:AA:AA:AA:AA
- Host B: 192.168.10.20, MAC BB:BB:BB:BB:BB:BB
When A wants to send a packet to B:
- A checks its ARP cache for 192.168.10.20.
- If no entry exists, A sends a broadcast ARP Request: "Who has 192.168.10.20? Tell 192.168.10.10."
- Every host on the LAN sees the ARP Request.
- B recognizes the IP as its own and sends unicast ARP Reply back to A: "192.168.10.20 is at BB:BB:BB:BB:BB:BB."
- A: Stores 192.168.10.20 → BB:BB:BB:BB:BB:BB in its ARP cache. Encapsulates IP packets to 192.168.10.20 using that MAC as destination in Ethernet frames.
From then on, A can send to B without new ARP Requests until the ARP entry ages out.
ARP and Gateways
When Host A sends to a remote destination, say 10.0.0.5:
- Host A's routing logic determines that 10.0.0.5 is not on the local subnet.
- It selects the default gateway (e.g. 192.168.10.1) as the next hop.
- ARP is used to resolve 192.168.10.1 → MAC of the gateway.
- A encapsulates the packet with: Destination MAC = gateway's MAC Destination IP = 10.0.0.5 (unchanged)
The router then forwards the packet and, on its outgoing interface, uses ARP again to resolve the next hop's MAC in the next subnet.
ARP Cache Aging and Refresh
Dynamic ARP entries have an aging timer:
- Common values: A few minutes to tens of minutes, depending on OS/vendor.
- If an entry is not used within that time: It is removed from the ARP cache.
- If traffic continues: The OS will refresh the timer or re-learn the entry.
Why aging matters:
- Prevents stale mappings from lingering if: An IP address moves to a different MAC. A device leaves the network.
- Allows the network to adapt over time.
IPv6 Note - NDP Instead of ARP
NDP (Neighbor Discovery Protocol) as "ARP for IPv6"
In IPv6, there is no ARP protocol.
Instead, IPv6 uses Neighbor Discovery Protocol (NDP), built on ICMPv6, to:
- Resolve IPv6 address → MAC (neighbor discovery).
- Discover routers (Router Advertisements).
- Perform Duplicate Address Detection (DAD).
- Manage prefix and neighbor information.
NDP messages (Neighbor Solicitation/Advertisement) conceptually serve the same role as ARP Requests/Replies in IPv4.
Why ARP Knowledge Still Helps in the IPv6 Era
Understanding ARP helps you:
- Understand that you always need a link-layer mapping of IP to MAC on a LAN.
- Recognize similar security issues: Just as ARP can be spoofed, NDP can be abused (RA spoofing, ND spoofing).
- Apply the same mental model: "Neighbor cache" in IPv6 plays a similar role to ARP cache in IPv4.
So even as IPv6 adoption grows, ARP remains a foundational concept.
ARP Security - Attacks and Protections
ARP Spoofing/Poisoning - What Can Go Wrong
ARP was designed in a more trusting era:
- It has no authentication or integrity checks.
- Any host can send ARP Replies (even unsolicited) claiming: "IP X is at MAC Y."
This allows attackers to:
- Poison ARP caches: Bind an important IP (e.g. default gateway) to the attacker's MAC.
- Launch: Man-in-the-middle attacks (traffic flows through attacker). Denial of service (drop or misroute traffic).
Classic scenario:
- Attacker sends fake ARP Replies telling hosts: "Gateway IP is at attacker MAC."
- All traffic to the gateway is then sent to the attacker first.
Basic Defenses - Static ARP and Segmentation
- Static ARP: For very small, fixed networks, static ARP entries can protect critical hosts/gateways. Prevents ARP spoofing on those specific mappings. Not scalable for general enterprise networks.
- Segmentation: Keep broadcast domains reasonably small. Use VLANs and L3 boundaries to limit the scope of ARP attacks.
These help, but are not enough on their own for large environments.
Dynamic ARP Inspection (DAI) and ARP Guard
Modern switches can implement Dynamic ARP Inspection (names vary by vendor):
- Builds a trusted IP-MAC-port binding database, usually from DHCP Snooping.
- Inspects ARP packets traversing the switch: If ARP claims don't match the trusted binding, they are dropped.
Other related mechanisms:
- ARP ACL / ARP security - define allowed IP-MAC mappings.
- IP Source Guard - only allow IP traffic from known IP-MAC-port bindings.
Together, features like:
- DHCP Snooping
- DAI
- IP Source Guard
provide effective, scalable protection against ARP spoofing in modern enterprise networks.
ARP in Real Devices - Commands and Practical Troubleshooting
Viewing ARP Tables on Hosts
On hosts, ARP tables show IPv4 ↔ MAC mappings known by the OS:
- Windows: arp -a
- Linux: ip neigh (preferred) arp -n (legacy)
- macOS: arp -a
You can:
- Check if a given IP is mapped to the expected MAC.
- Spot suspicious entries (e.g. multiple important IPs pointing to the same unknown MAC).
Viewing ARP Tables on Routers and Switches
On network devices:
- Cisco-like platforms: show arp
- Huawei / H3C / Ruijie / NS (depending on OS): display arp or similar commands.
Use cases:
- Confirm if the gateway has an ARP entry for a host that can't reach it.
- Check if a host's IP is associated with an unexpected MAC (possible spoof).
- Verify if ARP entries are being learned on the correct interface/VLAN.
Common ARP-Related Issues and How to Diagnose Them
Symptoms that might be ARP-related:
- Host can't ping another host in the same subnet.
- Only some hosts can reach the gateway.
- Connectivity "comes and goes" without obvious link issues.
Possible ARP-centric causes:
- Wrong IP-MAC mapping (static misconfig or spoofed).
- ARP entry missing because ARP Requests/Replies are blocked or not answered.
- Duplicate IP: two devices claiming the same address.
Basic troubleshooting steps:
- Check ARP tables on host and gateway.
- Clear ARP entries and see if they re-learn correctly: Host: arp -d (Windows), ip neigh flush (Linux). Router: clear arp / clear ip arp.
- Use packet capture (tcpdump/Wireshark) to: See if ARP Requests are sent. See who is responding (or if no one is).
ARP, Switches, and Advanced Features (Enterprise Perspective)
ARP on Layer 3 Switches and Routers
Layer 3 devices:
- Maintain an ARP table per L3 interface or VLAN.
- Use ARP to forward IP packets within the directly connected subnet.
If ARP breaks on an L3 interface:
- Routing to that subnet breaks, even if routing tables are correct.
- You may see routes present but pings from gateway to host failing due to ARP issues.
ARP and DHCP Snooping Integration
DHCP Snooping:
- Observes DHCP exchanges to learn: Which IP-MAC pairs are assigned to which access ports.
DAI (Dynamic ARP Inspection):
- Uses these DHCP-learned bindings as a trust source.
- Verifies ARP packets against the binding database.
Together:
- DHCP Snooping + DAI form a strong defense against ARP spoofing while allowing normal dynamic ARP operation.
ARP and High-Availability Features (VRRP/HSRP)
Virtual gateway protocols (VRRP, HSRP, GLBP):
- Provide a virtual IP (gateway IP) and virtual MAC shared by multiple routers.
ARP behavior:
- Hosts ARP for the gateway IP → learn the virtual MAC.
- When failover occurs: Backup router takes over the virtual IP/MAC. Often sends gratuitous ARP to update host caches.
This interplay is essential to:
- Achieve seamless gateway failover.
- Avoid long outages due to stale ARP entries.
Summary
In 2026, ARP is still a fundamental piece of IPv4 networking:
- It maps IPv4 addresses to MAC addresses so packets can actually be delivered on Ethernet.
- Dynamic ARP learns mappings automatically, making networks easy to use.
- Static ARP can be a powerful safety tool in small, highly controlled environments.
However:
- ARP was not designed with security in mind.
- Modern networks must protect against ARP spoofing using: DHCP Snooping Dynamic ARP Inspection IP Source Guard Proper segmentation and host hardening
Understanding ARP:
- Helps you troubleshoot real-world connectivity issues.
- Makes it easier to design secure, robust IPv4 networks.
- Provides a mental model that carries over to IPv6's Neighbor Discovery Protocol (NDP) and other neighbor mechanisms.
If you get ARP right-and secure it properly-you remove a huge source of "mysterious" network issues.
Did this article help you or not? Tell us on Facebook and LinkedIn . We’d love to hear from you!
