Skip to main content

Short note: ARP

Short answer

ARP (RFC 826) resolves a known IP address to its MAC address on a LAN. It broadcasts an ARP request, the owner sends a unicast reply, and the mapping is cached; for remote hosts, ARP asks for the default gateway's MAC.

Write a short note on ARP.

ARP (Address Resolution Protocol, RFC 826) finds the MAC (data-link) address of a host when only its IP address is known. It is needed because frames are delivered using MAC addresses on a LAN.

Operation

  1. A host wants to send to IP B on the same network. It checks its ARP cache.
  2. If no entry exists, it broadcasts an ARP request (destination MAC FF:FF:FF:FF:FF:FF): "Who has IP B? Tell A."
  3. All hosts receive it, but only B replies with a unicast ARP reply containing its MAC.
  4. A stores the mapping in its cache (for a few minutes) and sends the frame.

If the destination is on another network, the host ARPs for the default gateway's MAC instead.

A: "Who has 192.168.1.5?"  --broadcast-->  all
B: "192.168.1.5 is at 00:1A:2B:3C:4D:5E" --unicast--> A

ARP packet fields

Hardware type, protocol type, hardware length (6), protocol length (4), operation (1 request, 2 reply), sender MAC, sender IP, target MAC, target IP (28 bytes for Ethernet/IPv4).

Related: RARP (MAC to IP, obsolete), Proxy ARP (a router answers for hosts on another network), Gratuitous ARP (announces own mapping).

✓ Answer checked by Claude Opus 5.5 (high effort)

All Computer Networks and Security chapter 4 questions →