ARP (Address Resolution Protocol)

🧭

On this page — click any heading below to jump straight to it. ⬅️ Back to P-II.II. Computer Communications & Networks

---

OSI Layer: Network Layer / Data Link boundary (resolves L3 → L2)

Definition

ARP (Address Resolution Protocol) resolves a known IP address (Network layer, logical address) to the corresponding MAC address (Data Link layer, physical address) of a device on the same local network, so a frame can actually be addressed and delivered on the LAN.

Why It's Needed

• The Network layer routes using IP addresses, but the Data Link layer can only deliver a frame to a MAC address on the local segment
• Before a host can send a frame to another host (or its default gateway) on the same LAN, it must know that destination's MAC address — ARP is the mechanism that fills this gap

How ARP Works

1. Host A wants to send to an IP address on the same LAN but doesn't have that host's MAC address cached
2. Host A broadcasts an ARP Request frame ("Who has IP X? Tell IP Y") to the entire LAN (broadcast MAC address FF:FF:FF:FF:FF:FF)
3. Every host on the LAN receives the broadcast, but only the owner of IP X replies
4. That host sends an ARP Reply directly (unicast) to Host A, containing its MAC address
5. Host A stores the IP-to-MAC mapping in its ARP cache for a limited time, avoiding repeated broadcasts for the same destination

ARP Cache

A table of recently resolved {IP address → MAC address} mappings, kept with a timeout, on every host and router — reduces broadcast traffic by reusing recent mappings instead of re-broadcasting for every packet.

Reverse ARP (RARP) and Related Concepts

• RARP (largely obsolete, replaced by DHCP/BOOTP) — a diskless host with a known MAC address asks the network to supply its IP address, i.e., the reverse mapping
• Gratuitous ARP — a host announces its own IP-to-MAC mapping unprompted, often used to update other hosts' caches after a MAC change (e.g., failover) or to detect IP conflicts

Security Note

ARP has no authentication, which enables ARP spoofing/poisoning — an attacker sends forged ARP replies to associate their own MAC with another host's (e.g., the gateway's) IP, redirecting traffic through themselves (a man-in-the-middle attack). See the Network Attacks page.

CSS Exam Angle

• A classic short question: "What is ARP and how does it work?" — the request-broadcast/reply-unicast sequence with a simple diagram is usually sufficient
• Be ready to explain why ARP is needed at all (the IP-to-MAC gap between L3 and L2) — examiners test whether the reasoning, not just the mechanics, is understood
• Mention ARP spoofing as the security angle, linking Network Layer content to Special Topics/Security

Example

When a computer on a home network wants to send a packet to the router (its default gateway) for the very first time after booting up, it doesn't yet know the router's MAC address even though it knows the router's IP — so it broadcasts an ARP request; the router replies with its MAC address, and every subsequent packet on that LAN segment uses the cached MAC directly, without repeating the broadcast.

Likely Questions

1. Explain the purpose and working of ARP with a step-by-step example.
2. Why is ARP needed even though a host already knows the destination's IP address?
3. What is an ARP cache, and why does it matter for network efficiency?
4. Explain ARP spoofing/poisoning as a security concern.

📜 Past-Paper Questions & Structured Answers

Questions are paraphrased; answer focus is suggested guidance, not an official marking scheme.

2019 · Paper-II · Q5(b) · 6 marks

Question (paraphrased): Show how ARP discovers a node’s MAC address.

Answer focus: Six ordered steps, with the same-subnet/gateway distinction.

1. Choose next hop: compare the destination with the local prefix. For a same-subnet destination, resolve its IPv4 address; for a remote destination, resolve the local default gateway instead.
2. Check cache: look for an existing IPv4-to-MAC mapping.
3. Broadcast request: if missing, send an ARP request in a frame addressed to FF:FF:FF:FF:FF:FF, naming the target IPv4 address.
4. Receive reply: the target normally sends a unicast response containing its MAC address.
5. Cache mapping: the requester stores it temporarily to avoid repeating resolution for every packet.
6. Send frame: use the discovered MAC as the next-hop frame destination; the IP destination remains the intended final host.

Example: 192.168.1.10 wants to reach local 192.168.1.20. ARP resolves .20’s MAC. To reach an external website through gateway .1, the sender resolves .1, not the website’s remote MAC.

2020 · Paper-II · Q5(b) · 5 marks

Question (paraphrased): Explain why ARP and RARP are needed and what each does.

Answer focus: Direction of mapping, operation, use case and modern replacement.

ARP bridges logical addressing and local frame delivery. RARP historically helped diskless machines learn an address before normal IP communication. RARP requires server mappings and provides limited configuration; BOOTP and DHCP superseded it. IPv6 uses Neighbour Discovery rather than ARP.