CCNA online course

Address Resolution Protocol (ARP)

Learn how ARP maps IPv4 addresses to MAC addresses, handles local and remote traffic, maintains ARP caches, and helps troubleshoot Ethernet connectivity.

Address Resolution Protocol (ARP) maps an IPv4 address to a Layer 2 MAC address on a local network. IPv4 identifies the logical destination of a packet, while Ethernet uses MAC addresses to deliver frames across a local link.

This lesson explains ARP requests and replies, ARP caches, default-gateway resolution, Ethernet encapsulation, troubleshooting, security risks, and the IPv6 alternative.

What ARP Does

An IPv4 address is a logical Layer 3 address used for end-to-end packet delivery. A MAC address is a Layer 2 hardware address used to deliver an Ethernet frame on a local network segment.

When a host sends an IPv4 packet over Ethernet, it must place that packet inside an Ethernet frame. The frame needs a destination MAC address. If the host knows only the destination IPv4 address, ARP discovers the corresponding MAC address.

ARP therefore connects two addressing systems:

  • IPv4 address: logical addressing used by IP routers and hosts.
  • MAC address: link-layer addressing used by Ethernet switches and network interfaces.
  • ARP: the IPv4 address-resolution protocol that finds a local Layer 2 address for the next delivery step.

ARP operates within a local broadcast domain, commonly a single VLAN. It is not a routing protocol, and it does not discover MAC addresses across routed networks.

When ARP Is Used

Communication within the same subnet

A sender compares the destination IPv4 address with its own address using the subnet mask. If the destination is local, the sender must resolve the destination host's IPv4 address to a MAC address.

For example, PC-A is configured as 192.168.10.10/24 and PC-B is configured as 192.168.10.20/24. Both addresses belong to 192.168.10.0/24, so PC-A ARPs for PC-B's address.

Communication with a remote subnet

If the destination is outside the sender's subnet, the sender does not ARP for the remote host. It ARPs for the IPv4 address of its default gateway, which is the local router interface used as the next hop.

For example, PC-A at 192.168.10.10/24 sends to Server-B at 192.168.20.20/24 through a gateway at 192.168.10.1. PC-A resolves 192.168.10.1 to a MAC address. The IP packet still has Server-B as its destination, but the first Ethernet frame is addressed to the gateway's MAC address.

At every routed hop, the router removes the incoming Layer 2 frame and creates a new Layer 2 frame for the outgoing interface. The Layer 3 packet is forwarded toward its destination, while the Ethernet source and destination MAC addresses change at each hop.

ARP Request and Reply Operation

  1. The host needs to send an IPv4 packet.
  2. It determines whether the destination is local or remote by comparing addresses and subnet masks.
  3. It checks its ARP cache for a valid matching IPv4-to-MAC entry.
  4. If a valid entry exists, the host sends the data in a unicast Ethernet frame without broadcasting a new ARP request.
  5. If no valid entry exists, the host creates an ARP request.
  6. The request is carried in an Ethernet broadcast frame with destination MAC FF:FF:FF:FF:FF:FF.
  7. Every device in the local broadcast domain receives the broadcast. A switch normally floods it within the VLAN, except back out the receiving port.
  8. The device that owns the requested IPv4 address sends an ARP reply, normally as a unicast frame to the requester.
  9. The requester stores the learned IPv4-to-MAC mapping in its ARP cache.
  10. The requester sends the waiting IPv4 packet in a unicast Ethernet frame.

An ARP request asks, in effect, “Which device owns this IPv4 address?” The request includes the sender's address information so the target can respond.

Routers do not forward Layer 2 broadcasts by default. Consequently, an ARP request remains in its local broadcast domain. A remote network must perform its own ARP process on its own local segment.

Request and reply comparison

Purpose: ARP request — ask for the MAC associated with an IPv4 address. ARP reply — provide that MAC address.

Ethernet destination MAC: ARP request — FF:FF:FF:FF:FF:FF. ARP reply — normally the requester's unicast MAC address.

Ethernet delivery type: ARP request — broadcast. ARP reply — normally unicast.

Target MAC field: ARP request — commonly all zeros because the target MAC is unknown. ARP reply — contains the target or recipient MAC information as appropriate.

Typical recipient behavior: ARP request — all devices inspect the requested IPv4 address, but only the owner normally replies. ARP reply — the requesting host records the mapping.

Opcode: ARP request — 1. ARP reply — 2.

ARP Message Fields

An ARP message contains fields that describe the address formats and the sender and target identities:

  • Hardware type: identifies the link-layer technology. Ethernet is the common value.
  • Protocol type: identifies the network-layer protocol being resolved. IPv4 is the common value for ARP.
  • Hardware address length: the length of a hardware address. Ethernet MAC addresses are 6 bytes.
  • Protocol address length: the length of the protocol address. IPv4 addresses are 4 bytes.
  • Operation code: identifies the operation, commonly request 1 or reply 2.
  • Sender MAC address: the sender's Layer 2 address.
  • Sender IPv4 address: the sender's IPv4 address.
  • Target MAC address: the target's MAC address. In a typical request, this is unknown and represented by zeros.
  • Target IPv4 address: the IPv4 address whose MAC address is being requested or reported.

The Ethernet broadcast destination and the ARP target fields are different concepts. A request uses the Ethernet broadcast address so all local devices can inspect it, while the target MAC field is usually zero because the requested MAC is not yet known.

ARP Tables and Caches

An ARP cache, also called an ARP table, is a local list of IPv4-to-MAC mappings. Hosts and routers consult it before generating an ARP broadcast.

  • Dynamic ARP entry: learned from ARP activity and removed or aged after a platform-specific timer. The mapping can be relearned later.
  • Static ARP entry: manually configured and not dependent on normal dynamic learning. Static entries require careful maintenance if hardware or addressing changes.
  • Incomplete or unresolved entry: some systems display a temporary entry while waiting for an ARP reply.

A valid cache entry reduces broadcasts and allows immediate unicast transmission. When an entry ages out, becomes invalid, or is removed, the next packet may trigger a new ARP request.

ARP entries are associated with local interface and Layer 2 context. On a router or multilayer switch, the same IPv4 address can require different resolution behavior on different interfaces or VLANs.

Example cache interpretation

Default gateway mapping: 192.168.10.1 — 00:11:22:33:44:01 — dynamic — VLAN 10. This is the MAC used for remote destinations from that subnet.

Local peer mapping: 192.168.10.20 — 00:11:22:33:44:20 — dynamic — VLAN 10. This permits direct local unicast delivery.

Static mapping: 192.168.10.50 — 00:11:22:33:44:50 — static — VLAN 10. The mapping was configured rather than learned normally.

Incomplete mapping: 192.168.10.99 — unresolved — incomplete — VLAN 10. The device has attempted resolution but has not received a usable reply.

Same-Subnet and Remote-Destination Decisions

Host on same subnet: destination relationship — local; IPv4 address queried by ARP — destination host; Ethernet destination learned — destination host's MAC; IP destination retained — destination host.

Host on remote subnet through default gateway: destination relationship — remote; IPv4 address queried by ARP — default gateway; Ethernet destination learned — gateway's MAC; IP destination retained — remote host.

The remote case is essential: the router's MAC address is used only for the current Ethernet hop. It does not replace the final IPv4 destination in the packet.

ARP and Ethernet Encapsulation

ARP messages are transported directly in Ethernet frames rather than inside ordinary IPv4 packets. The switch handles the frame according to its VLAN and broadcast behavior.

For a same-subnet exchange, the sequence is:

  1. PC-A broadcasts an ARP request in the VLAN.
  2. The switch floods the broadcast to other ports in that VLAN.
  3. PC-B recognizes its IPv4 address and sends a unicast ARP reply to PC-A.
  4. PC-A sends subsequent IP data in a unicast Ethernet frame addressed to PC-B's MAC.

For a remote exchange, the first frame is addressed to the default gateway's MAC. The router then routes the packet and builds a new frame on the next interface. Each router-facing LAN resolves only the next local MAC address.

Packet Flow Examples

First communication with a same-subnet host

  1. PC-A, 192.168.10.10/24, generates application traffic for PC-B, 192.168.10.20/24.
  2. PC-A determines that PC-B is local.
  3. PC-A checks its ARP cache and finds no valid entry.
  4. PC-A broadcasts an ARP request for 192.168.10.20.
  5. The switch floods the request inside the VLAN.
  6. PC-B sends a unicast ARP reply containing its MAC address.
  7. PC-A inserts the mapping into its ARP cache.
  8. PC-A sends the IP packet in a unicast frame addressed to PC-B.

Communication with a remote network

  1. PC-A, 192.168.10.10/24, generates traffic for Server-B, 192.168.20.20/24.
  2. PC-A determines that Server-B is remote.
  3. PC-A ARPs for gateway 192.168.10.1, not for Server-B.
  4. PC-A creates an IP packet whose destination remains 192.168.20.20.
  5. PC-A encapsulates the packet in a frame addressed to the gateway's MAC.
  6. The router decapsulates the frame, routes the packet, and resolves the next-hop MAC on its outgoing network if needed.
  7. The final router on Server-B's LAN ARPs for Server-B and delivers the packet locally.

Cached mapping

If PC-A already has a valid entry for PC-B, it skips the ARP broadcast and sends unicast data immediately. A new exchange may occur after the entry expires, is cleared, or no longer matches the target's current MAC.

No ARP response

If a host receives no ARP reply, it cannot learn the destination MAC. An IP ping can therefore fail before an ICMP Echo Request is ever sent. Repeated requests with no reply point toward an addressing, VLAN, link, filtering, or endpoint problem.

Special ARP Behavior

Gratuitous ARP

Gratuitous ARP is an unsolicited ARP announcement or validation message. It is not necessarily sent because a host first received a request.

Common uses include:

  • Detecting a duplicate IPv4 address.
  • Announcing a new or changed MAC address.
  • Updating neighboring caches after failover.
  • Advertising a virtual gateway or a newly active interface.

A gratuitous ARP can be legitimate, such as during a first-hop redundancy transition, but unexpected announcements should be investigated.

Proxy ARP

With proxy ARP, a router answers an ARP request on behalf of another device or destination. The requester learns the router's MAC and sends the frame to the router, which forwards the packet.

Proxy ARP can help legacy or incorrectly subnetted hosts communicate, but it may hide incorrect subnet masks or a poor network design. Understand the addressing and routing design before relying on it.

ARP Security Risks

ARP spoofing, also called ARP poisoning, occurs when a device sends false ARP information so a victim stores an incorrect IPv4-to-MAC mapping.

If a rogue device claims to own the default gateway's IPv4 address, traffic can be redirected through that device. Possible effects include:

  • Traffic interception and man-in-the-middle positioning.
  • Credential or data exposure if higher-layer protections are absent.
  • Denial of service by directing traffic to an unreachable MAC address.
  • Traffic redirection or selective disruption.

Defensive measures include:

  • Dynamic ARP Inspection: validates ARP messages, commonly using DHCP snooping bindings.
  • DHCP snooping: builds trusted IP-to-MAC-to-port bindings used by inspection features.
  • Port security: limits or validates MAC addresses on access ports.
  • Static ARP entries: useful only for limited, carefully managed cases.
  • Segmentation: reduces the scope of a broadcast domain and limits exposure.
  • Monitoring: detects changing gateway MAC addresses, conflicting replies, and suspicious ARP traffic.

Conceptual Cisco IOS / IOS XE protection example

ip dhcp snooping
ip dhcp snooping vlan <vlan-id>
ip arp inspection vlan <vlan-id>
interface <trusted-uplink-interface>
 ip arp inspection trust

Apply trust only to interfaces that should carry validated upstream traffic. DHCP snooping and Dynamic ARP Inspection must be designed together, especially when endpoints use static IPv4 addresses.

Common ARP Failure Causes

  • Incorrect IPv4 address or subnet mask.
  • Host and peer assigned to different VLANs.
  • Disconnected cable, failed interface, or disabled switchport.
  • Duplicate IPv4 addressing.
  • ARP or other traffic filtered by a security feature.
  • Missing or incorrect default gateway.
  • Gateway interface down or configured in the wrong VLAN.
  • Incorrect static ARP entry.

ARP Troubleshooting

Local host cannot reach another host in the same subnet

  1. Confirm both hosts have valid IPv4 addresses and compatible subnet masks.
  2. Check physical link and interface state.
  3. Verify switchport VLAN membership.
  4. Inspect the ARP cache for an absent, incomplete, or unexpected mapping.
  5. Capture ARP traffic and determine whether a request is sent and whether a reply returns.
  6. Confirm that the target is powered on, connected, and using the expected IPv4 address.

Host reaches local peers but not remote networks

  1. Verify the default gateway address and subnet mask.
  2. Check whether the host can resolve the gateway with ARP.
  3. Compare the gateway ARP MAC with the router interface MAC.
  4. Verify the gateway interface, VLAN, and routing configuration.

Changing gateway MAC mappings or intermittent connectivity

  1. Compare ARP entries from multiple hosts.
  2. Look for repeated gratuitous ARP messages or conflicting replies.
  3. Check switch MAC address movement and security logs.
  4. Validate DHCP snooping bindings and Dynamic ARP Inspection status.

Dynamic ARP Inspection drops valid-looking traffic

  1. Verify DHCP snooping is enabled for the relevant VLAN when its database is being used.
  2. Determine whether the endpoint uses DHCP or a static address.
  3. Confirm that required uplinks are trusted.
  4. Review inspection counters and logs.
  5. Use a suitable static validation method only when justified by the design.

Useful commands

On Cisco IOS or IOS XE:

show ip arp
show ip arp <ipv4-address>
clear arp-cache
ping <ipv4-address>
show ip interface brief
show interfaces switchport
show mac address-table dynamic
arp <ipv4-address> <mac-address> arpa

Use clear arp-cache only during controlled testing because it removes dynamically learned entries and may temporarily increase ARP traffic.

On Windows:

arp -a
arp -d *

On Linux:

ip neigh show
sudo tcpdump -ni <interface> arp

Symptoms and likely causes

ARP requests with no replies: likely a wrong address, wrong VLAN, link failure, powered-off target, filtering, or incorrect subnet mask. Verify addressing, interface state, VLAN membership, and a packet capture.

Incorrect MAC for gateway: likely ARP spoofing, duplicate addressing, failover, or a bad static entry. Compare router interface information, host caches, logs, and switch MAC learning.

Unexpected ARP broadcasts: likely cache aging, a busy or large broadcast domain, repeated unresolved destinations, or scanning. Inspect cache timers, unresolved entries, and traffic captures.

Duplicate address warning or changing mappings: likely duplicate IPv4 configuration, failover, or spoofing. Check gratuitous ARP, host configurations, and MAC address movement.

ARP inspection drops: likely missing DHCP snooping bindings, an untrusted uplink, a static-IP endpoint without validation, or incorrect VLAN configuration. Review bindings, trust settings, and inspection logs.

ARP and IPv6

ARP applies to IPv4. IPv6 does not use ARP. IPv6 uses Neighbor Discovery Protocol (NDP), which is implemented with ICMPv6 messages. NDP performs address resolution and several related functions for IPv6 networks.

Exam-Relevant Notes

  • An ARP request normally uses Ethernet destination FF:FF:FF:FF:FF:FF.
  • An ARP reply is normally unicast to the requester.
  • A local destination causes ARP for the destination host.
  • A remote destination causes ARP for the default gateway.
  • The remote IP destination remains unchanged while the Ethernet destination is the next-hop MAC.
  • Routers do not forward Layer 2 broadcasts by default.
  • A valid ARP cache entry suppresses a new ARP broadcast until the entry expires or is invalidated.
  • ARP resolves IPv4 on a local broadcast domain; it does not resolve remote hosts across routed networks.
  • IPv6 uses NDP rather than ARP.

Summary

ARP lets IPv4 devices build Ethernet frames by mapping a local IPv4 address to a MAC address. The sender broadcasts a request when no valid cache entry exists, the owner normally returns a unicast reply, and the sender caches the result. Same-subnet traffic resolves the destination host, while remote traffic resolves the default gateway. Each router performs new Layer 2 resolution on its outgoing network. ARP caches improve efficiency, but incorrect mappings, VLAN problems, duplicate addresses, and spoofing can prevent or redirect communication.