What Is The Address Resolution Protocol?

Date First Published: 2nd June 2022

Topic: Computer Networking

Subtopic: Internet Protocols

Article Type: Computer Terms & Definitions

Difficulty Level: 9/10

Learn more about what the Address Resolution Protocol is in this article.

The Address Resolution Protocol (ARP), is a protocol used to map an IP address to a fixed MAC address in a LAN. ARP works by translating the 32-bit IPv4 address to a 48-bit MAC address and works between Layer 2 and Layer 3 of the OSI model. The MAC address works in the datalink layer to establish a connection between two devices in order for data transfer to occur and the IP address works in the network layer. It is responsible for forwarding data packets through different routers and was defined in RFC 826 in November 1982 by David C. Plummer.

Note:

When data packets are sent with IPv6, the Neighbour Discovery Protocol (NDP) is used. This is because they are 128 bits rather than 32 bits. They require more configuration information than ARP. Even though IPv4 are more common, the usage of IPv6 is increasing.

How Does ARP Work?

Every time a new computer joins a network, it will receive a unique IP address, used for the purposes of identification and communication. Data packets then arrive at the gateway, which then requests a MAC address that matches the IP address from the ARP program. The ARP cache is a table that keeps a list of every IP address and its corresponding MAC address. ARP cache is kept by all operating systems on an IPv4 Ethernet network.

Whenever a host requests a MAC address to transmit a data packet to another host in the LAN, the ARP program checks its ARP cache to find out whether the IP to MAC address translation already exists in the cache. If not, ARP is performed and the request for network addresses is sent. If it already exists, there is no need to carry out a new ARP request.

Usually, IP to MAC addresses only remain in the cache for a few minutes. It is removed to free up space on a regular basis. In addition, the limited design of the ARP cache size is used for security and privacy. It helps prevent IP addresses from being stolen or spoofed by attackers. When the address is not found, it broadcasts a request packet to all the hosts on the LAN and asks if any hosts are using that IP address. If a valid host is located, the information will be sent to the gateway and the ARP cache will be updated with the new information.

Note:

Reverse ARP can be used for hosts that don’t know their own IP addresses.

Types Of ARP

• Proxy ARP – This allows a network proxy to answer an ARP query for an IP address that is outside of the network, enabling data packets to be transferred from one subnet to another.
• Gratuitous ARP – Similar to an administrative procedure, it is a method of a host to update its IP to a MAC address.
• Inverse ARP – This works the other way around. Instead of ARP using an IP address to find a MAC address, IARP uses a MAC address to find an IP address.

What Is ARP Spoofing?

ARP spoofing, also known as ARP cache poisoning or ARP poison routing is a type of attack that occurs when an attacker sends fake ARP messages to a LAN for linking their MAC address with the IP address of a legitimate computer or server within the network, enabling the data from the victim’s computer to be sent to the attacker’s computer. This type of attack is harmful and dangerous as sensitive information may be sent to the attacker’s computer, causing data theft. In addition, it enables other types of cyberattacks, such as man-in-the-middle attacks, DDoS attacks, and session hijacking.