ARP: Mechanisms, Variants, and Security Risks Explained

Full Name: Address Resolution Protocol

Definition: ARP is a core link-layer protocol in TCP/IP networks that maps a device’s logical IPv4 address to its physical MAC (Media Access Control) address. This translation is critical because IPv4 addresses are used for routing traffic across networks, while MAC addresses are required for data transmission within a local area network (LAN).

Core Working Mechanism

ARP operates in a request-response (client-server) model within a broadcast domain:

ARP RequestWhen a host wants to send data to another device on the same LAN but only knows its IPv4 address, it broadcasts an ARP request packet to all devices in the LAN. The packet contains:
- The sender’s IPv4 address and MAC address.
- The target IPv4 address (the device being queried) and a blank target MAC address field.
ARP ReplyOnly the device with the matching target IPv4 address will respond. It sends a unicast ARP reply packet back to the sender, containing its own MAC address.
ARP CacheAll devices maintain a local ARP cache table to store recently resolved IPv4-MAC mappings. Entries have a timeout (typically 2–10 minutes) to ensure freshness, as MAC addresses may change (e.g., when a device is replaced or reconnected).

Key Variants & Related Protocols

RARP (Reverse Address Resolution Protocol): Maps a MAC address to an IPv4 address. Primarily used by diskless workstations that lack a preconfigured IP address.
Proxy ARP: A technique where a router responds to ARP requests on behalf of a remote device, making the remote device appear as if it is on the local LAN.
InARP (Inverse Address Resolution Protocol): Used in Frame Relay networks to resolve the IPv4 address of a peer device from its DLCI (Data Link Connection Identifier).
NDP (Neighbor Discovery Protocol): The IPv6 equivalent of ARP. It integrates ARP functionality with additional features like router discovery and prefix auto-configuration, and does not rely on broadcast (uses multicast instead).

Limitations & Security Risks

Broadcast Overhead: ARP requests are broadcast packets, which can consume bandwidth in large LANs if the ARP cache timeout is too short.

ARP Spoofing/Poisoning: An attacker sends fake ARP messages to associate their MAC address with a legitimate device’s IPv4 address, allowing them to intercept, modify, or block traffic (a common man-in-the-middle attack vector).