How ARP Works: IP to MAC Address Resolution

The Address Resolution Protocol (ARP) is how a device on an IPv4 network finds the hardware (MAC) address that belongs to an IP address on the same local network. IP addresses tell packets where they are going across the internet, but on the final hop an Ethernet or Wi-Fi frame has to be addressed to a specific network card. ARP bridges those two layers: it asks “who has this IP?” and remembers the answer.

Why two kinds of address exist

Networking is built in layers, and each layer has its own idea of an address.

• IP addresses live at the network layer. They are logical, assigned by configuration or DHCP, and organized into subnets so routers can forward traffic across many networks. Our guide to CIDR notation and subnetting explains how those ranges are carved up.
• MAC addresses live at the data link layer. They are 48-bit identifiers associated with a network interface, and they only mean something on the local network segment.

When your laptop sends a packet to a server on the other side of the world, the IP destination stays the same the whole way. But each hop is a separate local delivery: laptop to home router, router to the next router, and so on. For each of those hops, the sender must wrap the packet in a frame addressed to the next device’s MAC address. ARP is how it learns that MAC address.

The request and reply

Suppose a host at 192.168.1.20 wants to send a packet to 192.168.1.1, its default gateway, and does not yet know the gateway’s MAC address.

1. The host checks its subnet. It compares the destination with its own address and subnet mask. If the destination is on the same subnet, it resolves the destination directly. If not, it resolves the default gateway instead, because that is the next hop. (You can check which addresses share a subnet with our subnet calculator.)
2. It broadcasts an ARP request. The frame goes to the broadcast MAC address ff:ff:ff:ff:ff:ff, so every device on the segment receives it. In plain terms, it says: “Who has 192.168.1.1? Tell 192.168.1.20,” and includes the sender’s own IP and MAC.
3. The owner replies directly. The device configured with 192.168.1.1 sends a unicast ARP reply back: “192.168.1.1 is at aa:bb:cc:dd:ee:ff.”
4. Both sides cache the result. The requester stores the mapping, and the responder typically records the requester’s mapping too, since it learned it from the request and will probably need to reply.

Only then does the original IP packet go out, wrapped in a frame addressed to the gateway’s MAC.

The ARP cache

Broadcasting before every packet would be wasteful, so each host keeps an ARP cache, a small table of recent IP-to-MAC mappings. Most operating systems let you inspect it with a command such as arp -a or ip neigh.

Entries expire after a period of inactivity, which keeps the table accurate when devices leave the network or an IP address is reassigned to different hardware. If an entry has gone stale and traffic is still flowing, the host re-verifies it, often with a unicast request to the old MAC before falling back to a broadcast.

There is a related message called gratuitous ARP: an unsolicited announcement in which a device broadcasts its own IP-to-MAC mapping. Hosts use it when an interface comes up, to detect duplicate IP addresses, and during failover, when a standby machine takes over a shared IP and needs every neighbor to update its cache right away.

Where ARP fits in a real request

ARP is invisible most of the time, but it sits underneath almost everything on an IPv4 local network. Before a browser on your laptop can complete a TLS handshake with a remote server, your machine must have resolved the gateway’s MAC address. Before a container on a bridge network can reach another container, the host’s virtual network does the same lookup; our explainer on Docker networking modes shows where those virtual segments come from.

ARP only works within a single broadcast domain. Routers do not forward ARP broadcasts, which is one reason large flat networks are split into subnets and VLANs: it keeps broadcast traffic contained.

ARP vs IPv6 Neighbor Discovery

IPv6 does not use ARP. It replaces it with the Neighbor Discovery Protocol (NDP), which runs over ICMPv6 and uses multicast rather than broadcast. Our comparison of IPv4 vs IPv6 covers the broader differences.

	ARP (IPv4)	NDP (IPv6)
Transport	Its own Ethernet frame type	ICMPv6 messages
Discovery method	Broadcast to all hosts	Multicast to a targeted group
Messages	Request and reply	Neighbor solicitation and advertisement, plus router messages
Extra duties	Address resolution only	Also router discovery, address autoconfiguration, duplicate detection
Built-in authentication	None	None by default

Why ARP needs protecting

ARP was designed for small, trusted networks. It has no authentication: a host generally accepts a reply as true, and many implementations update their cache from unsolicited replies. That means a device on the same segment can claim to own an IP address it does not own, redirecting traffic through itself. This is a classic way to set up a man-in-the-middle attack on a local network, and it is conceptually similar to DNS cache poisoning, where a resolver is tricked into caching a false answer.

The defenses are well established:

• Dynamic ARP Inspection on managed switches checks ARP messages against a trusted table of IP-to-MAC bindings, usually built by DHCP snooping, and drops messages that do not match.
• Port security and network access control limit which devices can connect to a switch port in the first place.
• Network segmentation keeps untrusted devices, such as guest Wi-Fi clients, off the segments where sensitive systems live.
• Static entries for critical devices like the gateway, used sparingly because they are hard to maintain.
• End-to-end encryption. The most important layer. If traffic is protected by TLS or mutual TLS, a redirected packet stream is still unreadable and tamper-evident. This is the core idea behind zero trust security: never assume the local network is safe.

The takeaway

ARP translates IPv4 addresses into MAC addresses so that packets can be delivered on the local hop. A host broadcasts a request, the owner replies, and both sides cache the answer for a while. It is simple, fast, and limited to one broadcast domain, and IPv6 replaces it with Neighbor Discovery. Because ARP trusts whatever it hears, well-run networks back it up with switch-level inspection, segmentation, and, above all, encryption that does not depend on the local network being honest.