ARP (Address Resolution Protocol)
How a device figures out the MAC address behind a known IP address.
The Problem ARP Solves
When your device wants to send data to another device on the same local network, it knows the destination's IP address (Network layer) โ but to actually deliver the data at the hardware level, it needs the destination's MAC address (Data Link layer). ARP is the protocol that bridges this gap, translating a known IP address into its corresponding MAC address.
How ARP Works, Step by Step
1) The sending device broadcasts an ARP Request to the entire local network, essentially asking 'who has this IP address? Tell me your MAC address.' 2) Every device on the network receives this broadcast, but only the device that actually owns that IP address responds. 3) That device sends back an ARP Reply directly to the sender, containing its MAC address. 4) The sender now has what it needs to correctly address the frame at the hardware level.
The ARP Cache
To avoid repeating this broadcast process for every single packet, devices maintain an ARP cache โ a temporary table storing recently learned IP-to-MAC mappings. Before sending an ARP Request, a device first checks its cache; if the mapping is already known, it skips the broadcast entirely and sends data immediately. Cache entries expire after a set time to keep information current.
ARP Only Works on the Local Network
ARP broadcasts don't cross routers โ they're limited to the local network segment (this is intentional, otherwise ARP broadcasts would flood the entire internet). When communicating with a device outside the local network, your device instead resolves the MAC address of its default gateway (router), and the router handles forwarding onward.
ARP Spoofing โ A Security Concern
Because ARP has no built-in authentication, a malicious device on the same network can send FAKE ARP replies, claiming to own an IP address it doesn't actually control โ this is called ARP spoofing, and it's used in man-in-the-middle attacks to intercept traffic meant for another device. This is one reason secure networks use additional protections like Dynamic ARP Inspection on managed switches.
๐ Real-World Use
Every time your laptop sends its FIRST message to your home printer or another local device, ARP quietly runs in the background to discover that device's MAC address โ you never see this happen, but 'ping' or file-sharing to a local device wouldn't work without it.
๐ก Pro Tip
A classic exam question: 'why doesn't ARP work across the internet?' โ the correct answer is that ARP relies on broadcasting within a single local network segment, and routers deliberately do NOT forward broadcast traffic between different networks โ this containment is a core design choice, not a limitation.
๐งช Quick Self-Test
Check what you just learned โ no pressure, just practice.
1. What does ARP translate an IP address into?
2. Where is an ARP Request sent?
3. What is ARP Spoofing?