ARP Fundamentals

The gap ARP fills

To send an IP packet over Ethernet, a host must put it in a frame, and a frame needs a destination MAC address. The host knows the destination's IP address (you typed it, or DNS provided it), but not its MAC address. ARP (Address Resolution Protocol) asks the local network: "Who has this IP address? Tell me your MAC address."

💡 In simple terms: you know a colleague's name but not where they sit, so you stand up and call out across the office: "Who is Sam? Please wave!" Everyone hears you, but only Sam waves back, and now you remember where Sam sits. The shout is the ARP request, the wave is the reply, and your memory is the ARP cache.

Why ARP exists

Every network device has two addresses that do different jobs:

• The IP address is a logical address used end to end. Applications and people use it.
• The MAC address is a hardware address that only has meaning on one local link. Switches and network cards use it.

Learn more: What Is an IP Address? · MAC Addresses

Nothing in the IP address tells you the MAC address. They are set independently: the IP address by DHCP or an administrator, and the MAC address by the manufacturer (or randomly by the operating system, on many phones and laptops). So something has to look up the MAC address at the moment it is needed. On IPv4 networks, that is ARP.

Where ARP sits

ARP works on the local subnet only. Its messages are carried directly in an Ethernet frame with EtherType 0x0806 (normal IPv4 traffic uses 0x0800). There is no IP header in an ARP message, so a router has no destination IP address to route it with, and it does not forward ARP messages to other networks.

The important parts

The example network

Request and reply

Step by step

The same exchange as a message flow

Inside an ARP message

An ARP message for IPv4 over Ethernet is 28 bytes long. It is padded to the Ethernet minimum frame size, so on the wire it fills a 64-byte frame.

The frames that carry them

Notice that there is no IP header in either frame: the IP addresses are fields inside the ARP message. IPv6 doesn't use ARP at all. It uses Neighbor Discovery instead.

Local or remote?

A host only sends ARP requests for addresses on its own subnet. For any other destination, it sends an ARP request for its default gateway and sends the frame to the gateway's MAC address. The packet inside keeps the remote destination IP address. This is why the most used entry in most PCs' ARP caches is the router. The topic is important enough to have its own lesson.

Learn more: ARP for Local and Remote Destinations

The ARP cache

Answers are cached so that ARP isn't needed for every packet. Entries expire after seconds to minutes on most PCs, and after 4 hours by default on Cisco routers. If a device's MAC address changes (for example, after a network card is replaced or a failover), stale entries can send traffic to the old MAC address for a while.

Before PC-A has talked to anyone, its cache is nearly empty:

C:\> arp -a
Interface: 192.168.10.10 --- 0xb
  Internet Address      Physical Address      Type
  192.168.10.255        ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  255.255.255.255       ff-ff-ff-ff-ff-ff     static

After PC-A has talked to PC-B and to the internet:

C:\> arp -a
Interface: 192.168.10.10 --- 0xb
  Internet Address      Physical Address      Type
  192.168.10.1          02-00-00-00-00-01     dynamic
  192.168.10.20         02-00-00-00-00-bb     dynamic
  192.168.10.255        ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  255.255.255.255       ff-ff-ff-ff-ff-ff     static

$ ip neigh
192.168.10.1 dev eth0 lladdr 02:00:00:00:00:01 REACHABLE
192.168.10.20 dev eth0 lladdr 02:00:00:00:00:bb STALE

R1#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.10.1            -   0200.0000.0001  ARPA   GigabitEthernet0/0
Internet  192.168.10.10          12   0200.0000.00aa  ARPA   GigabitEthernet0/0
Internet  192.168.10.20           3   0200.0000.00bb  ARPA   GigabitEthernet0/0

What happens when ARP fails

ARP has no built-in security: any device can answer, and hosts believe the answer. Attackers abuse this with ARP spoofing. The ARP Security lesson (CCNA track) explains how networks defend against it. Special ARP messages, such as gratuitous ARP, have their own lesson.

Learn more: ARP Security · Gratuitous ARP, Probes and Proxy ARP

Troubleshooting ARP

1. Ping the address you can't reach. This triggers an ARP request if there is no cache entry.
2. Look at the ARP cache with arp -a or ip neigh. Is there an entry for the next hop (the host itself, or the default gateway for remote traffic)?
3. No entry, or FAILED: the target didn't answer. Check that it is powered on, connected, in the same VLAN, and has the IP address you expect.
4. An entry with an unexpected MAC address: there is a duplicate IP address or an old cache entry. Compare it with the MAC address on the device itself (ipconfig /all), then clear the cache.

Common mistakes

• Thinking a PC sends ARP requests for remote IP addresses, such as a web server on the internet. The remote server can't receive the broadcast, so the PC sends an ARP request for its default gateway instead.
• Thinking the reply is a broadcast. Only the request is a broadcast. The reply is a unicast, because the target already knows the sender's MAC address from the request.
• Confusing the ARP cache with a switch's MAC address table. The ARP cache on hosts and routers maps IP address → MAC address; a switch's table maps MAC address → port (see How a Switch Learns MAC Addresses).
• Expecting ARP to cross a router. ARP requests are broadcasts, and broadcasts stay in their own subnet.

Check yourself