hop 10 of 32 · 5 min

Finding the hardware address

You know the destination IP address. To send an Ethernet frame you need its MAC address, and nothing so far provides one.

The exchange

code

broadcast: "who has 192.168.1.1? tell 192.168.1.50"
   every device on the segment receives this

unicast:   "192.168.1.1 is at a4:83:e7:2f:91:0c"
   only the owner replies

The answer is cached for a few minutes, so this happens once per destination rather than per packet.

code

$ arp -a
gateway (192.168.1.1) at a4:83:e7:2f:91:0c on en0
laptop  (192.168.1.50) at 3c:22:fb:11:8a:02 on en0

Which address is looked up

The step people get wrong. ARP is only ever used for a destination on the same subnet.

code

destination on my subnet?
  yes -> ARP for the destination itself
  no  -> ARP for the default gateway, and send the frame there

Sending to a server in another country does not ARP for that server; the local segment has never heard of it. It ARPs for the router, which then forwards on. This is why the IP address is end to end and the MAC address is one hop, seen from the other side.

Gratuitous ARP

A device can announce its own mapping unprompted. It is used when an address moves: a failover pair taking over a shared address sends one so every switch and host updates immediately instead of waiting for a cache to expire.

ARP spoofing

There is no authentication. Any device can answer any request, or announce any mapping.

code

attacker: "192.168.1.1 is at my MAC address"

Everyone now sends their outbound traffic to the attacker, who forwards it on and reads it in passing. That is a man in the middle attack achieved with one unauthenticated broadcast, and it is why traffic on a network you do not control should be assumed readable, and why TLS matters even inside a company.

Defences are all at the switch: static entries, dynamic ARP inspection, port security. None of them are on by default on ordinary hardware.

IPv6 does it differently

IPv6 has no ARP. Neighbour Discovery uses ICMPv6 multicast instead of broadcast, so only devices likely to care are interrupted, and it can be secured cryptographically, which ARP cannot.