NETWORK
ARPAddress Resolution Protocol
ARP (Address Resolution Protocol) finds the MAC address that belongs to an IPv4 address on the local network. A host broadcasts "who has 192.168.1.1?", the owner replies with its MAC, and the answer is cached. Every packet sent to a local host or to the default gateway depends on it. IPv6 uses Neighbour Discovery instead.
Why ARP is needed
IP addresses identify hosts across networks; MAC addresses deliver frames on one link. To send an IP packet to a neighbour, a host must put the neighbour's MAC in the Ethernet frame, and ARP is how it learns that MAC.
PC (192.168.1.20) → broadcast FF-FF-FF-FF-FF-FF
"Who has 192.168.1.1? Tell 192.168.1.20"
Router (192.168.1.1) → PC
"192.168.1.1 is at A4-5E-60-1B-2C-3D"The PC caches the answer for a few minutes (Windows uses a randomised timeout around 15–45 seconds for unused entries and refreshes entries in use). Only local destinations are resolved; for anything outside the subnet the host resolves the default gateway's MAC instead.
The ARP cache
Every host keeps a table. On Windows:
arp -aInterface: 192.168.1.20 --- 0xb
Internet Address Physical Address Type
192.168.1.1 a4-5e-60-1b-2c-3d dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff staticA stale entry (a device whose MAC changed, such as a replaced router with the same IP) causes traffic to go nowhere until the entry expires; arp -d forces a refresh. The arp record covers the command.
Uses beyond basic resolution
- Duplicate address detection: a host probes for its own address before using it.
- Gratuitous ARP announces a new mapping, used by high-availability pairs when a virtual IP moves.
- Proxy ARP: a router answers on behalf of hosts on another segment, mostly a legacy technique.
- Network discovery: scanning tools ARP every address in the subnet to list live hosts, which works even when ICMP is blocked.
Security
ARP has no authentication. Anyone on the segment can claim any address, which enables man-in-the-middle interception (ARP spoofing or poisoning). Mitigations: dynamic ARP inspection on managed switches, which validates replies against the DHCP snooping table; client isolation on guest Wi-Fi; and end-to-end encryption so that intercepted traffic is unreadable. Endpoint tools that alert on gateway MAC changes provide detection.
IPv6
IPv6 replaces ARP with Neighbour Discovery, using ICMPv6 multicast rather than broadcast. It has the same trust problem, addressed by RA Guard and SEND on managed networks. netsh interface ipv6 show neighbors displays the IPv6 neighbour cache on Windows.
Frequently asked questions
How do I view the ARP cache on Windows?
arp -a lists every interface's cached IP-to-MAC mappings, marked dynamic (learned) or static. arp -d * clears it; the next packet to each host triggers a fresh request.
What is a gratuitous ARP?
An unsolicited announcement in which a host advertises its own IP-to-MAC mapping. Devices send one when they start up (to detect duplicate addresses) and when their MAC changes, such as during a failover between two routers sharing a virtual IP.
What is ARP spoofing?
An attacker on the LAN sends forged replies claiming the gateway's IP is at the attacker's MAC. Victims then send their traffic through the attacker, who can read or modify it. Defences include dynamic ARP inspection on switches, static ARP entries for critical hosts, and encrypting traffic so interception yields nothing useful.