Address Resolution Protocol (ARP): What is the Header?

By : Bryce Leo Bryce Leo
Hours Updated

⚡ Smart Summary

Address Resolution Protocol (ARP) maps a 32-bit IPv4 address to a 48-bit MAC address so devices can communicate on a local network, using broadcast requests, cached replies, and header fields to bridge the network and data link layers.

  • 🔗 Purpose: ARP converts a known IP address into the MAC address needed to deliver frames on a local network.
  • 🗂️ ARP cache: Resolved mappings are stored in an ARP cache with a timeout, avoiding repeated broadcasts for known hosts.
  • 📡 Resolution: A host broadcasts an ARP request, and the device owning that IP returns a reply carrying its MAC address.
  • 🧩 ARP types: Proxy, Gratuitous, Reverse (RARP), and Inverse (InARP) ARP serve specialized addressing needs.
  • 🧾 Header fields: The ARP header carries hardware type, protocol type, address lengths, operation code, and sender and target addresses.
  • 🛡️ Security: ARP has no authentication, making it vulnerable to spoofing, so AI-based monitoring helps detect poisoning.
Read More

Address Resolution Protocol (ARP) in Networking

What is ARP?

Address Resolution Protocol (ARP) is an important protocol of the network layer in the OSI model, which helps find the MAC (Media Access Control) address of a device from its IP address. The main task of ARP is to convert a 32-bit IP address (for IPv4) into a 48-bit MAC address.

It is mainly used when one device wants to communicate with another device on a local network. The full form of ARP is Address Resolution Protocol.

How Address Resolution Protocol (ARP) works?

Every operating system in an IPv4 network maintains an ARP cache. When a host needs to send a packet to another host on the LAN, it first checks its ARP cache to see whether the MAC address translation is already present. If the mapping exists, the host reuses it; if not, the host broadcasts an ARP request to discover the MAC address.

The diagram below shows how a host resolves addresses and forwards a packet through intermediate routers until it reaches the destination:

ARP resolving a MAC address and routing a packet from host P through routers T1 and T2 to host U

Consider the following example:

  • Host P resolves the protocol address for host U when an application on P sends messages to U.
  • If P cannot resolve the protocol address for host U directly, it uses the internet layer to deliver the packet to U by routing through T1 and T2.
  • Host P resolves the T1 hardware address.
  • The network layer on host P passes the packet, which contains the destination protocol address for U, to T1 for delivery.
  • T1 delivers the packet to T2, which in turn forwards the packet to host U.

Important ARP terms

Here are the important terms associated with the Address Resolution Protocol:

  • ARP Cache: After resolving a MAC address, ARP stores it in a table (the cache) for future reference, so subsequent communications can reuse the MAC address without another broadcast.
  • ARP Cache Timeout: It is the time for which a resolved MAC address can reside in the ARP cache before it is removed.
  • ARP request: A packet broadcast over the network to check whether the sender can find the destination MAC address for a given IP address.
  • ARP response/reply: The MAC address reply that the source receives from the destination, which aids further communication of the data.

Address Resolution Methods

The association between a protocol address and a hardware address is known as binding. There are three techniques used for this purpose:

  • Table lookup: Bindings are stored in memory with the protocol address as the key. The data link layer checks the protocol address to find the corresponding hardware address.
  • Dynamic: This messaging method is used for “just-in-time” resolution. The data link layer sends a request message for a hardware address, and the destination responds.
  • Closed-form computation: In this method, the protocol address is based on the hardware address, so the data link layer can derive the hardware address directly from the protocol address.

RELATED ARTICLES

Types of ARP

Here are the four types of Address Resolution Protocol:

  • Proxy ARP
  • Gratuitous ARP
  • Reverse ARP (RARP)
  • Inverse ARP (InARP)

The illustration below summarizes the four ARP types before we examine each one in detail:

Chart summarizing the four types of ARP: Proxy, Gratuitous, Reverse, and Inverse

Proxy ARP

In the Proxy ARP method, Layer 3 devices can respond to ARP requests on behalf of another host. A configured router responds to the target IP address and maps its own MAC address to that target IP address, so the sender’s traffic reaches the intended destination through the router.

Gratuitous ARP

Gratuitous ARP is a request that a host sends for its own IP address. It helps the network identify a duplicate IP address. When a router or switch broadcasts a gratuitous ARP for its own IP address and receives no reply, it confirms that no other node is using the IP address allocated to that device.

Reverse ARP (RARP)

Reverse ARP, also called RARP, is a networking protocol used by a client system in a LAN to request its own IPv4 address from the ARP router table. The network administrator usually creates a table in the gateway router that maps each MAC address to a specific IP address.

Inverse ARP (InARP)

Inverse ARP, also called InARP, is used to find the IP addresses of nodes from their data link layer addresses. InARP is widely used in ATM networks and Frame Relay, where Layer 2 virtual-circuit addressing is acquired from Layer 2 signaling.

ARP Header

The ARP header contains the fields that both the request and the reply use to carry addressing information. The figure below shows the structure of the ARP header:

ARP header structure showing hardware type, protocol type, address lengths, operation code, and sender and target addresses

  • Hardware Type: It is 1 for Ethernet.
  • Protocol Type: It is the protocol used in the network layer.
  • Hardware Address Length: It is the length in bytes, so it would be 6 for Ethernet.
  • Protocol Address Length: Its value is 4 bytes.
  • Operation Code: It indicates whether the packet is an ARP request (1) or an ARP response (2).
  • Sender Hardware Address: It is the hardware address of the source node.
  • Sender Protocol Address: It is the Layer 3 address of the source node.
  • Target Hardware Address: It is used in a RARP request; the response then includes both the destination’s hardware and Layer 3 addresses.
  • Target Protocol Address: It is used in an ARP request; the response carries both the Layer 3 address and the destination’s hardware address.

Advantages of using ARP

Here are the pros and benefits of using ARP:

  • If you know the IP address of a system, its MAC address can easily be discovered using ARP.
  • End nodes do not need to be manually configured to “know” MAC addresses; they can be found when needed.
  • ARP allows each host on a network to build a mapping between IP addresses and physical (MAC) addresses.
  • The set of mappings stored in a host is called the ARP table or ARP cache.

FAQs

The ARP request is broadcast across the LAN, but no device replies because no host owns that IP address. The sender receives no MAC address, so the packet cannot be delivered and is eventually dropped after a timeout.

This is called a gratuitous ARP. The host announces its own IP-to-MAC mapping so other devices update their caches. If another machine replies, it signals a duplicate IP address conflict on the network, which an administrator must resolve.

ARP spoofing, or ARP poisoning, sends forged ARP replies that link an attacker’s MAC address to a legitimate IP address. Because ARP has no authentication, victims send traffic to the attacker, enabling man-in-the-middle interception, session hijacking, or denial of service.

No. ARP is specific to IPv4. IPv6 replaces it with the Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages to resolve link-layer addresses and detect duplicate addresses, providing similar mapping plus added features such as router discovery.

Run arp -a on Windows or Linux to list cached IP-to-MAC mappings. On Linux you can also use ip neigh. To remove a stale entry, use arp -d followed by the IP address, which forces a fresh resolution.

A dynamic entry is learned automatically through ARP requests and expires after a timeout. A static entry is configured manually and never ages out. Static entries improve resistance to spoofing but need maintenance whenever hardware or addresses change.

Yes. Machine-learning models baseline normal IP-to-MAC mappings and traffic patterns, then flag sudden changes, duplicate MAC bindings, or abnormal ARP reply rates that signal poisoning. AI speeds detection, though engineers still confirm alerts before blocking a suspected host.

GitHub Copilot drafts Python or shell scripts for tasks such as parsing ARP tables, pinging hosts, or automating cache checks from a short comment. Review the generated commands carefully before running them against production network devices.

Summarize this post with: