Address Resolution Protocol (ARP)

Learn how ARP maps IPv4 addresses to MAC addresses on Ethernet LANs using requests, replies, broadcasts, caching, and Windows verification.

Address Resolution Protocol (ARP) discovers the MAC address associated with a known IPv4 address on an Ethernet LAN. IPv4 provides a logical Layer 3 destination, but Ethernet needs a Layer 2 destination MAC address before it can deliver a frame.

This lesson explains ARP requests and replies, broadcast delivery, switch flooding, ARP caches, same-subnet and remote-network traffic, Windows verification, and basic troubleshooting.

What ARP Does

An IPv4 address is a logical address assigned to an IPv4 interface. A MAC address is a Layer 2 hardware address used in the source and destination fields of an Ethernet frame.

When a host wants to send an IPv4 packet over Ethernet, it must put that packet inside an Ethernet frame. The frame needs a destination MAC address. If the host knows the destination IPv4 address but does not know the corresponding MAC address, it uses ARP to find it.

ARP therefore maps a known IPv4 address to a MAC address for delivery across the current local network segment. The IPv4 destination identifies the intended host at Layer 3, while the Ethernet destination MAC identifies where the frame should go on the current Layer 2 network.

When ARP Is Used

Same-subnet communication

If the destination is in the same IPv4 subnet, the sending host resolves the destination host's MAC address when no usable mapping is already in its ARP cache.

Communication with a remote network

If the destination is outside the local subnet, the host does not ARP for the remote host's MAC address. It uses its IPv4 address and subnet mask to determine that the destination is remote, then resolves the MAC address of the local interface of its default gateway, if necessary.

The Ethernet frame is addressed to the gateway's MAC address, while the IPv4 packet still contains the remote host's IPv4 address as its destination. After the router receives the frame, it creates a new Layer 2 frame for the next hop. Layer 2 addresses can change at every routed hop.

ARP and IPv6

ARP is associated with IPv4. IPv6 uses Neighbor Discovery Protocol (NDP), which performs related neighbor-discovery functions using IPv6 and ICMPv6.

Important ARP Terms

  • ARP request: A broadcast query asking which device owns a specified IPv4 address.
  • ARP reply: A response that supplies the MAC address associated with the requested IPv4 address.
  • Broadcast: A delivery method received by every device in the local broadcast domain.
  • Unicast: A delivery method directed to one specific destination MAC address.
  • Broadcast domain: The set of interfaces that receive a Layer 2 broadcast. Routers normally bound broadcast domains, and VLANs separate them.
  • Switch flooding: A switch forwarding a broadcast out applicable ports in the same VLAN.
  • ARP cache: A host-maintained table of recently learned IPv4-to-MAC mappings.
  • ARP entry: One IPv4-to-MAC mapping in an ARP cache.

How an ARP Request and Reply Work

  1. The sender checks its ARP cache for the destination IPv4 address.
  2. If no usable entry exists, the sender creates an ARP request. The request includes the sender's own IPv4 address and MAC address, plus the IPv4 address it wants to resolve.
  3. The sender places the request in an Ethernet frame addressed to FF:FF:FF:FF:FF:FF, the Ethernet broadcast MAC address.
  4. The switch receives the broadcast and floods it out the applicable ports in the same VLAN, except the port on which the frame arrived.
  5. All hosts in that local broadcast domain receive the request. Only the host configured with the requested IPv4 address should normally respond.
  6. The target sends an ARP reply containing its MAC address. The reply is normally a unicast frame addressed to the requesting host's MAC address.
  7. The sender stores the IPv4-to-MAC mapping in its ARP cache.
  8. The sender encapsulates the waiting IPv4 packet in an Ethernet frame addressed to the resolved destination MAC address. This data frame is unicast.
ARP request:  Ethernet destination = FF:FF:FF:FF:FF:FF  (broadcast)
ARP reply:    Ethernet destination = Requester's MAC       (unicast)
Data frame:   Ethernet destination = Resolved MAC          (unicast)

ARP Request and ARP Reply Comparison

Message type | Purpose                         | Ethernet destination MAC       | Delivery | Typical sender | Typical receiver
ARP request  | Find the MAC for an IPv4 address | FF:FF:FF:FF:FF:FF              | Broadcast | Requesting host | All hosts in the VLAN
ARP reply    | Supply the requested MAC address  | Requester's MAC address        | Unicast   | Target host     | Requesting host

Worked Same-LAN Example

Assume Host A needs to send traffic to 10.0.0.2. Host A and the device using 10.0.0.2 are on the same Ethernet LAN, but Host A has no matching ARP-cache entry.

  1. Cache lookup: Host A checks its ARP cache and finds no mapping for 10.0.0.2.
  2. Broadcast request: Host A sends an ARP request in an Ethernet frame whose destination is FF:FF:FF:FF:FF:FF. This is a broadcast.
  3. Switch forwarding: The switch floods the broadcast through the relevant VLAN. Every host in that broadcast domain receives a copy.
  4. Target recognition: The host configured with 10.0.0.2 recognizes that the requested IPv4 address belongs to it.
  5. Unicast reply: The target sends an ARP reply directly to Host A's MAC address. This is a unicast frame.
  6. Cache update: Host A records the target IPv4 address and MAC address in its ARP cache.
  7. Data transmission: Host A sends the intended IPv4 packet inside an Ethernet frame addressed to the resolved target MAC address. The data frame is unicast.
Host A                  Switch                 Host B: 10.0.0.2
  |                        |                         |
  |-- ARP request -------->|                         |  Broadcast
  |   dst MAC:             |-- flood to VLAN ------>|
  |   FF:FF:FF:FF:FF:FF   |                         |
  |<-----------------------|<-- ARP reply -----------|  Unicast
  |  Store 10.0.0.2 - MAC |                         |
  |----------------------->|------------------------->|  IPv4 data, unicast

ARP Communication Sequence

Step               | Sender       | Frame destination             | Action                         | Result
Cache lookup       | Host A       | None                          | Check local ARP cache          | Mapping found or request needed
Broadcast request  | Host A       | FF:FF:FF:FF:FF:FF             | Ask for owner of 10.0.0.2      | Hosts in VLAN receive request
Switch forwarding   | Switch       | Applicable VLAN ports         | Flood the broadcast            | Target can inspect the request
Unicast reply       | Host B       | Host A's MAC                  | Return Host B's MAC             | Host A learns the mapping
Cache update        | Host A       | None                          | Store IPv4-to-MAC entry         | Future lookup can avoid broadcast
Data transmission   | Host A       | Host B's resolved MAC         | Send IPv4 packet in Ethernet    | Local unicast delivery

ARP Cache

An ARP cache is a local table of recently learned IPv4-to-MAC mappings. A host checks this table before creating a new ARP request.

Caching reduces repeated broadcasts and makes later communication faster. Dynamically learned entries are not normally permanent. They age out after a period determined by the operating system. When an entry expires, the host can perform ARP again the next time it needs the mapping.

An entry can be dynamic, learned through normal ARP activity, or static, manually configured or otherwise fixed by the system. Static and dynamic behavior varies by operating system and configuration.

Local Versus Remote IPv4 Destinations

Packet destination type | Address resolved with ARP       | Ethernet frame destination | Key point
Same-subnet host        | Destination host's IPv4 address | Destination host's MAC    | Frame goes directly to local host
Off-subnet host         | Default gateway's IPv4 address | Gateway's local MAC        | Remote host's MAC is not learned by ARP

For remote traffic, the IPv4 packet's destination remains the intended remote host. The Ethernet frame's destination is the local default gateway. This distinction is a frequent examination point.

ARP and Network Layers

ARP creates a classification ambiguity because it connects two addressing systems: IPv4 network-layer addresses and Ethernet data-link-layer addresses.

Some materials describe ARP as a Layer 2 protocol because ARP messages are carried in Ethernet frames and use MAC addresses. Other materials describe it as a Layer 3 protocol because it resolves a Layer 3 IPv4 address. It is also commonly described as operating at the Layer 2/Layer 3 boundary.

For practical troubleshooting and exam questions, focus on its function: ARP takes a known IPv4 address and discovers the MAC address needed for local Ethernet delivery.

Viewing ARP Entries on Windows

Open Command Prompt or PowerShell and run:

arp -a

The output displays ARP entries grouped by interface. An entry pairs an IPv4 address with a physical address, which is the MAC address, and includes an entry type such as dynamic or static depending on the system.

Interface: 10.0.0.10 --- 0x7
  Internet Address      Physical Address      Type
  10.0.0.2              00-11-22-33-44-55     dynamic

In this example, the interface context is 10.0.0.10, the IPv4 address 10.0.0.2 maps to MAC address 00-11-22-33-44-55, and the mapping was learned dynamically. Actual output and formatting can vary between Windows versions and network adapters.

Troubleshooting ARP Problems

No valid mapping for a same-LAN host

Symptom: A host cannot reach another host on the same LAN, and no valid MAC mapping appears for the target IPv4 address.

  • The target host may be powered off or disconnected.
  • The target may have an incorrect IPv4 address or subnet mask.
  • The hosts may be in different VLANs even though they appear to be on the same physical LAN.
  • A switch, cable, interface, or other physical-link problem may prevent the request or reply from passing.

Run arp -a, verify IPv4 addressing and subnet masks, check VLAN membership and link state, confirm that the target is available, then generate traffic again and see whether an entry is learned.

Local devices work but remote networks do not

Symptom: The host can reach local devices but cannot reach a remote network.

  • The default gateway may be missing or incorrect.
  • The host may be unable to resolve the default gateway's MAC address.
  • The gateway interface or upstream routing may be unavailable.

Confirm that the default gateway is in the local subnet. Check for an ARP entry corresponding to the gateway IPv4 address. If gateway resolution works, investigate routing beyond the gateway separately from the local ARP process.

Wrong or intermittent delivery

Symptom: Traffic reaches the wrong device or connectivity is intermittent.

  • A duplicate IPv4 address may be in use.
  • An incorrect or stale mapping may be present.
  • Unauthorized ARP replies may be influencing host caches. This is an ARP spoofing or poisoning concern.

Compare the observed MAC address with the expected address, investigate duplicate-address conditions, and examine whether unexpected ARP responses are being received.

Exam-Relevant Notes

  • An ARP request is normally broadcast to FF:FF:FF:FF:FF:FF.
  • A normal ARP reply is normally unicast to the requester.
  • All hosts in the local broadcast domain receive the request, but only the owner of the target IPv4 address should reply.
  • For a same-subnet destination, ARP resolves the destination host's MAC address.
  • For an off-subnet destination, ARP resolves the default gateway's local MAC address.
  • ARP caching prevents a new broadcast for every packet.
  • IPv6 uses Neighbor Discovery Protocol instead of ARP.
  • ARP is best understood as a protocol at the boundary between IPv4 addressing and Ethernet addressing.

Summary

ARP enables IPv4 communication over Ethernet by converting a known local IPv4 destination into the MAC address required for frame delivery. The sender first checks its ARP cache. If the mapping is absent, it broadcasts a request, the switch floods that request within the VLAN, and the target normally returns a unicast reply. The sender caches the result and sends subsequent data frames as unicast traffic. For remote destinations, the host resolves the default gateway's MAC address rather than the remote host's MAC address.