edVirtus Reference

What Is the Address Resolution Protocol?

How Does ARP Associate an IP Address with a Physical Network Address?

The Address Resolution Protocol (ARP) is a protocol used in IPv4 Ethernet networks to determine the physical MAC address associated with a known IP address. Because Ethernet delivers frames using MAC addresses rather than IP addresses, ARP provides the essential link between the network layer (IP) and the data link layer (Ethernet).

The basic principle is straightforward. Suppose a computer wishes to send an IP packet to another device on the same local area network. The sender already knows the destination IP address but not its MAC address. It therefore broadcasts an ARP Request asking, "Who has this IP address?" Every device on the LAN receives the request, but only the device whose IP address matches responds with an ARP Reply containing its MAC address. The sender stores this information in an ARP cache for future use, avoiding the need to repeat the request for every packet.

A useful analogy is knowing a person's street address but not their name on the letterbox. By asking the neighbours who lives at that address, you obtain the name needed to deliver the letter correctly. Similarly, ARP determines the MAC address required to deliver an Ethernet frame to the correct device.

Because ARP requests are broadcast to all devices on the local network, they generate a small amount of additional network traffic. Fortunately, ARP caches significantly reduce this overhead by retaining recently learned address mappings for a limited period. If the cached entry expires or the device changes its network interface, the address resolution process is repeated automatically.

One limitation of ARP is that it provides no mechanism for authenticating responses. Consequently, malicious devices can send false ARP replies, causing other devices to associate an IP address with the wrong MAC address. This attack, known as ARP spoofing or ARP poisoning, may enable traffic interception, man-in-the-middle attacks, or denial-of-service attacks. Modern enterprise networks often employ techniques such as Dynamic ARP Inspection (DAI) and port security to reduce these risks.

It is important to distinguish ARP from Neighbor Discovery Protocol (NDP). ARP is used exclusively with IPv4, whereas IPv6 replaces ARP with the more capable NDP, which also supports router discovery, address autoconfiguration, and neighbour reachability detection. Likewise, ARP differs from DNS, which resolves human-readable domain names into IP addresses rather than resolving IP addresses into MAC addresses.

Today, the Address Resolution Protocol remains a fundamental component of IPv4 networking. Although largely invisible to users, ARP enables Ethernet devices to communicate efficiently by bridging the gap between logical IP addressing and the physical MAC addresses required for local frame delivery. As IPv6 adoption continues to grow, ARP is gradually being replaced by Neighbor Discovery Protocol, but it remains indispensable throughout the vast installed base of IPv4 networks.