ARP links IPv4 to Ethernet by mapping an IP address to a MAC address on the local network. When a host needs to send a unicast frame and does not know the target MAC, it broadcasts an ARP Request to ff:ff:ff:ff:ff:ff. The request carries the sender’s MAC and IP and the target IP. The owner of that IP replies with an ARP Reply sent as a unicast, stating its MAC. The requester then stores the pair in its ARP cache so it can send future frames without another broadcast. Entries age out after a short period and can be static or dynamic. ARP operates only within a broadcast domain. Routers do not forward ARP, which is why a default gateway is needed to reach other subnets. The ARP message has simple fields. These include hardware type, protocol type, hardware size, protocol size, opcode, sender MAC, sender IP, target MAC and target IP. Variants exist. Gratuitous ARP is an unsolicited announcement that refreshes neighbour caches, helps failover pairs move a virtual IP, and can expose duplicate addresses. Proxy ARP lets a router reply on behalf of a downstream host so that a sender treats the router’s MAC as the next hop for that IP. ARP spoofing or poisoning abuses the trust in these messages. An attacker forges replies to divert traffic or create a denial of service. Defences include Dynamic ARP Inspection, DHCP snooping to build bindings, port isolation, segmentation with VLANs and static entries for critical systems. IPv6 does not use ARP. It uses Neighbour Discovery over ICMPv6. Understanding ARP is essential for fault finding because many reachability issues come down to missing or wrong cache entries and to broadcasts that never get a valid reply.
