Why ARP exists
On a local network, frames are delivered using MAC addresses, not IP addresses. When a host knows the IP address of a neighbor but not its hardware address, it uses the Address Resolution Protocol to find the MAC that owns that IP.
How resolution works
- The sender broadcasts an ARP request asking who has a given IP address.
- Every host on the link sees it, but only the owner replies.
- The owner sends an ARP reply containing its MAC address directly to the asker.
- The sender caches the mapping in its ARP table for future frames.
ARP only works within a single broadcast domain, so to reach a host on another network a sender resolves the MAC of its default gateway instead. Entries expire after a timeout to handle moves. Because any host can answer, a malicious machine can send forged replies in an attack called ARP spoofing, redirecting traffic through itself.
Key idea
ARP maps a local IP address to a MAC address by broadcasting a request and caching the reply.