ARP Address Resolution

Visualize ARP cache lookup, broadcast requests, unicast replies, gateway resolution, and spoofing risk

animation

arp

networking

ethernet

ipv4

cache

security

intermediate

Foundation networking IPv4 over Ethernet Interactive animation

ARP Address Resolution Workbench

Watch how a host turns an IPv4 destination into the Ethernet destination MAC address it must put on the wire. Compare a cache hit, a local cache miss, a default-gateway lookup, and an ARP spoofing attempt.

Cache miss Current path

ff:ff:ff:ff:ff:ff Ethernet destination MAC

No entry ARP cache decision

1 broadcast Broadcasts used

What

ARP maps an IPv4 address on the local link to a 48-bit Ethernet MAC address.

Why

IP decides where the packet should go. Ethernet still needs the next-hop MAC address before a frame can leave the host.

Try First

Use Step Event on Local cache miss. Notice the request is broadcast, but the reply is unicast.

Notice

For an off-subnet IP, the host does not ARP for the remote server. It ARPs for the default gateway.

Scenario

Preset

Controls

IPv4 destination

Spoofing protection

Cache age

0 s0 s1200 s

Cache timeout

60 s300 s1200 s

Step Cache adds 120 seconds of age so you can see when a dynamic entry expires and ARP has to run again.

Ethernet link view

Host A needs to send to the sensor, but it does not yet know the sensor MAC address.

1. Subnet decision

Packet fields

Frame purposeDecide next hop

Ethernet destUnknown until ARP runs

Sender192.168.10.10 at 9c:22:14:00:10:10

Target192.168.10.22 at unknown

ARP cache

Resolve 192.168.10.22 Address the host must learn before building the Ethernet frame.

Local destination On-link traffic resolves the final host. Off-link traffic resolves the gateway.

Normal ARP ARP has no built-in authentication, so protection must come from the network or static entries.

Current explanation

ARP starts by asking whether the destination is on the same subnet. Host A is 192.168.10.10/24. A destination inside 192.168.10.0/24 is local; anything else goes to the default gateway 192.168.10.1.

1. Subnet decision

Decide whether to send directly or to the default gateway.

2. Cache lookup

Use a valid cache entry if one exists and has not expired.

3. Request and reply

Broadcast the request, then learn from the unicast reply.

4. Send frame

Place the learned next-hop MAC in the Ethernet destination field.

Learning Support

Minimum Background

IPv4 addresses name endpoints for routing. MAC addresses name Ethernet interfaces on one local link.

Mental Model

ARP is a local question: "Who owns this IPv4 address on this link, and what MAC should I use next?"

Common Mistake

Do not ARP for a remote cloud host. ARP only finds the next-hop MAC on the local network.

Quick Reference

ARP Request

Ethernet destination is ff:ff:ff:ff:ff:ff. The target MAC field is unknown.

ARP Reply

Usually unicast to the requester. It carries the target IP to MAC mapping.

Cache Entry

Dynamic entries expire. Static entries stay fixed until an administrator changes them.

Gateway Case

For off-subnet traffic, the resolved IP is the default gateway, not the remote server.

Spoofing Risk

ARP does not authenticate replies. A host can be tricked into caching a false mapping.

Useful Commands

arp -a or ip neigh shows learned neighbor mappings on common systems.

Guided Practice

Cache Hit

Select Cache hit. No broadcast should be needed because Host A already has a fresh entry.

Cache Expiry

Press Step Cache until the entry is older than the timeout. The decision changes back to cache miss.

Gateway Lookup

Select Gateway needed. The ARP target becomes 192.168.10.1 even though the IP packet is going to 10.8.4.20.

Spoof Test

Select Spoof attempt with no protection. Then try Static ARP entry or Dynamic ARP Inspection.

Field Reading

Compare Ethernet destination with ARP target. The broadcast address appears only during request discovery.

Troubleshooting

If pings fail only to one local device, an expired, wrong, or poisoned ARP entry is a realistic suspect.