ARP Explained

How IP Addresses Find MAC Addresses

IP addresses tell us where a device is on a network. MAC addresses tell us who the device is locally.

But there is a problem. When your computer wants to send data to another device on the same network, it knows the destination IP address but it does not know the destination MAC address. Ethernet and Wi-Fi require MAC addresses to deliver frames.

ARP exists to solve this exact problem.

This article explains what ARP is, why it exists, and how it quietly enables almost every network communication you use.

What is ARP

ARP stands for Address Resolution Protocol.

ARP is a protocol used to map an IP address to a MAC address inside a local network.

It answers one simple question:

“Which MAC address belongs to this IP address?”

Without ARP, IP communication on local networks would not work.

Why ARP is needed

IP operates at a logical level. Ethernet and Wi-Fi operate at a physical delivery level.

IP can say:

“Send this packet to 192.168.1.10”

But the network card asks:

“What MAC address should I send this frame to?”

ARP bridges this gap between IP and MAC.

Where ARP operates

ARP works only inside a local network segment.

Important limitations:

• ARP does not cross routers

• ARP works only within a broadcast domain

• ARP is used before sending Ethernet or Wi-Fi frames

If the destination is outside your network, ARP resolves the MAC of the router, not the final destination.

How ARP works step by step

Let’s walk through a simple example.

Scenario

Your laptop wants to send data to 192.168.1.20 on the same Wi-Fi network.

Step 1. Check ARP cache

Your laptop checks its ARP table to see if it already knows the MAC address.

If found, communication continues immediately.

Step 2. Broadcast ARP request

If not found, your laptop sends an ARP request:

“Who has IP 192.168.1.20?”

This request is broadcast to all devices on the local network.

Step 3. Target device responds

The device with IP 192.168.1.20 replies:

“I am 192.168.1.20 and my MAC address is AA:BB:CC:DD:EE:FF”

Step 4. ARP cache is updated

Your laptop stores this mapping in its ARP table.

Step 5. Data transmission begins

Now your laptop can send Ethernet frames directly to that MAC address.

What an ARP packet contains

An ARP message includes:

• Sender IP address

• Sender MAC address

• Target IP address

• Target MAC address (empty in request)

ARP packets are simple and lightweight.

ARP cache explained

An ARP cache is a temporary table that stores IP-to-MAC mappings.

Why caching matters:

• Avoids repeated broadcasts

• Improves network performance

• Reduces latency

ARP entries expire after a short time to stay accurate.

You can view this table using commands like:

arp -a

ARP and routers

When sending data to the internet:

Your device resolves the MAC address of the default gateway

The router then handles ARP on the next network

MAC addresses change at every hop

This is why MAC addresses never travel across the internet.

ARP vs DNS

People often confuse ARP with DNS.

ARP

• Resolves IP to MAC

• Works locally

• Uses broadcast

DNS

• Resolves domain names to IP

• Works globally

• Uses servers

Both perform resolution but at different layers.

ARP security issues

ARP has no authentication.

This allows attacks like:

• ARP spoofing

• ARP poisoning

• Man in the middle attacks

Attackers send fake ARP replies to intercept traffic.

Mitigation methods include:

• Static ARP entries

• Switch security features

• Encrypted protocols like HTTPS

ARP itself is not secure by design.

Why ARP still exists today

Despite being old and insecure, ARP remains because:

• It is simple

• It is fast

• It works reliably in trusted local networks

Modern networks rely on encryption at higher layers instead of fixing ARP itself.

Common misconceptions

Misconception 1

ARP finds IP addresses on the internet. No. It works only locally.

Misconception 2

ARP replaces DNS. No. They solve different problems.

Misconception 3

ARP is optional. No. Ethernet IP communication depends on it.

Conclusion

ARP is a silent helper of networking. It maps IP addresses to MAC addresses so data can move across local networks. Every web page load, every file transfer, every ping depends on ARP. Understanding ARP completes the picture of how IP and Ethernet work together.