Upon completion of this tutorial, you should be able to:
In any network using the Internet Protocol (IP), hosts and routers need to know the link-layer address (MAC address) of the next-hop device on the same local network. The Address Resolution Protocol (ARP) provides the dynamic mapping between an IP address and its corresponding MAC address. This tutorial covers MAC addressing, the operation of ARP, its messages, cache management, and advanced topics such as gratuitous ARP, proxy ARP, and security concerns. Understanding ARP is essential for network troubleshooting and security, as ARP vulnerabilities are common attack vectors.
A MAC (Media Access Control) address is a 48-bit (6-byte) address assigned to a network interface card (NIC). It is typically represented as six groups of two hexadecimal digits separated by colons or hyphens (e.g., 00:1A:2B:3C:4D:5E).
The first three bytes (24 bits) are the Organizationally Unique Identifier (OUI), assigned by the IEEE to a manufacturer. The last three bytes are assigned by the manufacturer uniquely to each NIC. This ensures global uniqueness.
MAC addresses are flat (no hierarchy for routing), unlike IP addresses. They are used only for communication within a single broadcast domain (local network).
The LSB of the first byte indicates whether the address is unicast (0) or multicast (1). The second LSB indicates globally unique (0) or locally administered (1).
ARP is a protocol used to map an IP address to a MAC address within a local network. It is defined in RFC 826. ARP operates at the link layer (though it is often considered part of the network layer as a helper protocol).
When a host needs to send an IP datagram to another host on the same network, it must know the destination's MAC address. It uses ARP to resolve the IP address to a MAC address. If the destination is on a different network, the host resolves the MAC address of its default gateway.
The ARP process:
ARP request format includes hardware type (Ethernet), protocol type (IPv4), hardware address length, protocol address length, opcode (1=request, 2=reply), sender MAC, sender IP, target MAC, target IP.
To reduce ARP traffic, hosts maintain an ARP cache of recently resolved mappings. Each entry has a timeout (typically 30 seconds to 2 minutes in many systems, but can be longer). When an entry expires, it is removed, and the host must perform ARP again when needed. Some systems also allow static ARP entries (manually configured).
When a host receives an ARP request, it may also update its own cache with the sender's information (gratuitous learning). This is useful for detecting IP conflicts.
In a switched network, ARP broadcasts are flooded to all ports in the same VLAN (unless VLAN pruning is used). Switches do not forward ARP broadcasts beyond the VLAN boundary. Within a VLAN, ARP operates normally. When using VLANs, a router or Layer 3 switch is needed for inter-VLAN communication, and ARP for destinations outside the subnet resolves to the router's MAC.
ARP is stateless and lacks authentication, making it vulnerable to attacks:
IPv6 replaces ARP with the Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages. NDP provides address resolution (Neighbor Solicitation and Neighbor Advertisement), router discovery, and duplicate address detection. NDP includes security extensions (SEND) to prevent spoofing.
Common problems: incomplete ARP entries, stale cache, duplicate IP addresses, ARP storms. Tools:
arp -a (Windows/Linux), ip neigh (Linux). Ping can trigger ARP resolution. When
troubleshooting, check the ARP cache, ensure the correct gateway MAC, and verify that ARP broadcasts are not
being filtered by switches.
Question 1: What is the primary purpose of ARP?
(b) To map an IP address to a MAC address. ARP resolves IP addresses to MAC addresses for local network communication.
Question 2: Which of the following is the broadcast MAC address?
(b) FF:FF:FF:FF:FF:FF. The broadcast address is all ones.
Question 3: An ARP request is sent as:
(b) Broadcast. ARP requests are broadcast to all nodes on the local network.
Question 4: Which field in the ARP message indicates whether it is a request or reply?
(c) Opcode. Opcode 1 is request, 2 is reply.
Question 5: What is the length of a MAC address in bits?
(b) 48. MAC addresses are 48 bits (6 bytes).
Question 6: How does a host know the MAC address of a device on a different subnet?
(b) It sends the frame to the default gateway's MAC address. For off-subnet traffic, the host resolves the gateway's MAC and sends the frame to the gateway.
Question 7: What is the purpose of the ARP cache?
(b) To store recently resolved IP-to-MAC mappings. The cache reduces ARP traffic.
Question 8: Which of the following is a multicast MAC address?
(b) 01:00:5E:00:00:01. Multicast MACs have the LSB of the first byte set to 1.
Question 9: What is gratuitous ARP used for?
(b) To announce an IP-MAC mapping, often during IP address changes. Gratuitous ARP is used to update other devices' caches.
Question 10: Proxy ARP is typically performed by:
(b) A router. Proxy ARP allows a router to respond to ARP requests on behalf of hosts on other subnets.
Question 11: In an ARP request, which fields are filled with zeros?
(b) Target MAC only. The target MAC is set to zeros in an ARP request because it is unknown.
Question 12: What is the default ARP cache timeout in many operating systems?
(b) 30 seconds to 2 minutes. Typical timeout values vary; Windows uses about 30 seconds, Linux default is 60 seconds.
Question 13: ARP spoofing is a type of:
(b) Man-in-the-middle attack. ARP spoofing redirects traffic to the attacker.
Question 14: Which IPv6 protocol replaces ARP?
(b) Neighbor Discovery Protocol (NDP). NDP uses ICMPv6 messages for address resolution and other functions.
Question 15: What does the OUI in a MAC address represent?
(a) The manufacturer of the NIC. OUI (Organizationally Unique Identifier) is assigned to manufacturers by IEEE.
Question 16: How can a network administrator prevent ARP spoofing?
(d) All of the above. All these measures help mitigate ARP spoofing.
Question 17: In an ARP reply, the destination MAC address is:
(a) The source MAC of the request sender. ARP replies are unicast to the requesting host.
Question 18: What happens if a host receives an ARP request for its own IP address?
(d) Both (b) and (c). It replies and may also update its cache (gratuitous learning).
Question 19: Which command can be used to view the ARP cache on a Windows system?
(a) arp -a. This displays the ARP table.
Question 20: What is the effect of an ARP poisoning attack?
(b) Traffic is redirected to the attacker. ARP poisoning allows man-in-the-middle attacks.
Question 21: In a VLAN, ARP broadcasts are:
(b) Forwarded only within the same VLAN. Switches do not forward broadcasts across VLAN boundaries.
Question 22: What is the protocol number for ARP in the Ethernet frame?
(b) 0x0806. This EtherType identifies ARP frames.
Question 23: Why does a host send an ARP request when it needs to communicate with a destination on the same subnet?
(a) To find the destination's MAC address. ARP resolves the IP to a MAC for local delivery.
Question 24: What is a static ARP entry?
(b) An entry manually added by an administrator. Static ARP entries are configured and do not expire.
Question 25: Which of the following is a valid MAC address?
(b) 00-1A-2B-3C-4D-5E. This is a MAC address; others are IP addresses.
Question 26: What is the purpose of the "target MAC address" field in an ARP reply?
(b) It contains the MAC address of the target (the resolved address). In a reply, the target MAC is the requested address.
Question 27: In ARP, what does the "hardware type" field specify?
(a) The type of network medium (e.g., Ethernet). For Ethernet, it is 1.
Question 28: What is the difference between a gratuitous ARP request and a gratuitous ARP reply?
(b) A request has the target IP equal to the sender IP, a reply is the same but as a reply. Both can be used, but the most common gratuitous ARP is a request with the same IP.
Question 29: What does the "protocol address length" field indicate in an ARP message?
(b) The length of the IP address (e.g., 4 for IPv4). For IPv4, it is 4 bytes.
Question 30: Which of the following can be used to defend against ARP spoofing?
(d) All of the above. These are all effective mitigation strategies.
Exercise 1: ARP Request/Reply Flow
Describe the steps that occur when Host A (IP 192.168.1.10, MAC AA:AA:AA:AA:AA:AA) wants to send a packet to Host B (IP 192.168.1.20, MAC unknown) on the same LAN. Include the ARP message types and the fields in each.
1. A checks its ARP cache; no entry for B.
2. A broadcasts an ARP request: sender MAC=AA:AA:AA:AA:AA:AA, sender IP=192.168.1.10, target IP=192.168.1.20, target MAC=00:00:00:00:00:00, opcode=1.
3. All nodes receive the request; B recognizes its IP.
4. B sends a unicast ARP reply to A: sender MAC=BB:BB:BB:BB:BB:BB, sender IP=192.168.1.20, target MAC=AA:AA:AA:AA:AA:AA, target IP=192.168.1.10, opcode=2.
5. A receives the reply, updates its cache with B's MAC.
6. A now sends the data frame to B's MAC address.
Exercise 2: ARP Cache Update
Host A (IP 10.0.0.1, MAC 00:11:22:33:44:55) receives an ARP request from Host C (IP 10.0.0.3, MAC 66:77:88:99:AA:BB) asking for the MAC of 10.0.0.4. Does A update its ARP cache? If so, what entry does it add?
Yes, A will update its ARP cache with the sender's information: IP 10.0.0.3 maps to MAC 66:77:88:99:AA:BB. This is called gratuitous learning.
Exercise 3: Gratuitous ARP
Explain a scenario where a host sends a gratuitous ARP request and describe the expected behavior of other hosts on the network.
Scenario: A host has just been assigned a new IP address via DHCP. It sends a gratuitous ARP request (target IP = its own IP) to announce its new mapping. Other hosts that receive this request will update their ARP caches with the new mapping, ensuring they send future packets to the correct MAC. If another host responds (indicating an IP conflict), the host can detect it.
Exercise 4: Proxy ARP
Host A (IP 192.168.1.10, subnet mask 255.255.255.0) wants to send a packet to Host B (IP 10.0.0.5, which is on a different subnet). The router has IP 192.168.1.1 on the local subnet. How does ARP help Host A send the packet?
Host A determines that B is not on the same subnet. It needs to send the packet to its default gateway (192.168.1.1). It broadcasts an ARP request for 192.168.1.1. The router replies with its MAC address. Host A then sends the frame to the router's MAC. The router forwards the packet. If proxy ARP is enabled on the router, it might respond to ARP requests for 10.0.0.5 with its own MAC, but normally Host A resolves the gateway's MAC anyway.
Exercise 5: ARP Spoofing Attack
Describe how an attacker can perform an ARP spoofing attack to become a man-in-the-middle between Host A and Host B. What frames does the attacker send?
Attacker sends forged ARP replies to Host A, associating Host B's IP with the attacker's MAC. Also sends forged ARP replies to Host B, associating Host A's IP with the attacker's MAC. Now traffic between A and B goes through the attacker. The attacker can sniff, modify, or drop packets.
Exercise 6: ARP Table Analysis
Given the output of arp -a on a Windows machine:
Interface: 192.168.1.10 --- 0x3
Internet Address Physical Address Type
192.168.1.1 00-1a-2b-3c-4d-5e dynamic
192.168.1.20 00-1a-2b-3c-4d-5f dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
Which entries are valid? Why is 192.168.1.255 listed? What does "static" mean?
All entries are valid. 192.168.1.255 is the broadcast address; it has a static entry so the system knows the broadcast MAC. "Static" means the entry was manually added or is permanent and will not expire. Dynamic entries are learned via ARP and have a timeout.
Exercise 7: ARP Request Format
Fill in the fields of an ARP request sent by Host X (IP 10.0.0.1, MAC 00:11:22:33:44:55) to resolve IP 10.0.0.2.
Hardware type: _____, Protocol type: _____, HLEN: _____, PLEN: _____, Opcode: _____, Sender MAC: _____, Sender IP: _____, Target MAC: _____, Target IP: _____.
Hardware type: 1 (Ethernet), Protocol type: 0x0800 (IPv4), HLEN: 6 (MAC length), PLEN: 4 (IP length), Opcode: 1 (request), Sender MAC: 00:11:22:33:44:55, Sender IP: 10.0.0.1, Target MAC: 00:00:00:00:00:00, Target IP: 10.0.0.2.
Exercise 8: ARP Cache Timeout
Why do ARP cache entries have a timeout? What could happen if they never expired?
Timeouts allow the cache to adapt to changes in the network, such as a host changing its MAC address (e.g., due to a new NIC). If entries never expired, stale mappings could cause communication failures. Without timeouts, an ARP cache would become increasingly large and could contain obsolete entries.
Exercise 9: VLAN and ARP
Host A in VLAN 10 sends an ARP request for Host B in the same VLAN. Does the request reach Host B? What if Host B is in VLAN 20?
In the same VLAN, the broadcast reaches Host B. In different VLANs, the ARP broadcast is not forwarded across VLANs, so Host B does not receive it. Host A would need to send the packet to a router (Layer 3 device) to communicate with another VLAN.
Exercise 10: Duplicate IP Detection
How can a host detect an IP address conflict using ARP?
When a host is assigned an IP (e.g., via DHCP), it can send a gratuitous ARP request for its own IP. If it receives an ARP reply, then another host is using that IP, indicating a conflict. Some systems also send ARP probes before using an address.
Exercise 11: ARP and Switches
How does a switch handle an ARP broadcast frame? Does the switch forward it to all ports or only to the port where the target might be?
A switch floods the broadcast frame to all ports in the same VLAN (except the incoming port) because it does not know which port the target MAC is on. This is how broadcasting works in switched networks.
Exercise 12: Static ARP Advantages
When would you use static ARP entries? What are the disadvantages?
Static ARP is used for critical devices (e.g., routers, servers) to prevent ARP spoofing and to ensure consistent mapping. Disadvantages: administrative overhead, lack of scalability, and difficulty managing changes when hardware is replaced.
Exercise 13: ARP Poisoning Mitigation
Explain how Dynamic ARP Inspection (DAI) works to prevent ARP spoofing.
DAI is a switch feature that validates ARP packets. It uses a trusted database (e.g., DHCP snooping bindings) to check that the sender's IP and MAC in an ARP packet are legitimate. If not, the packet is dropped. DAI also monitors the rate of ARP packets to prevent flooding attacks.
Exercise 14: IPv6 NDP vs ARP
List two advantages of IPv6 Neighbor Discovery Protocol (NDP) over ARP.
1. NDP uses secure neighbor discovery (SEND) with cryptographic certificates, protecting against spoofing. 2. NDP is more efficient; it uses multicast instead of broadcast, reducing network load.
Exercise 15: ARP Request Generation
If a host needs to send a packet to an IP address that is not in its ARP cache, but the destination is on the same subnet, what is the first action it takes?
It broadcasts an ARP request for that IP address.
Homework 1: Explain the difference between an ARP request and an ARP reply in terms of the destination MAC address, opcode, and who sends them. Provide a step-by-step example with IP and MAC addresses.
ARP request: destination MAC = broadcast (FF:FF:FF:FF:FF:FF), opcode = 1, sent by a host needing a MAC address. ARP reply: destination MAC = sender's MAC (unicast), opcode = 2, sent by the host whose IP was queried, providing its MAC. Example: Host A (IP 10.0.0.1, MAC AA:AA) sends request for 10.0.0.2. Host B (IP 10.0.0.2, MAC BB:BB) sends reply to AA:AA.
Homework 2: Describe the ARP cache poisoning attack in detail. How can an attacker perform it, what are the consequences, and what mitigation strategies exist?
ARP cache poisoning (spoofing) involves an attacker sending forged ARP replies to associate their MAC with a legitimate IP (e.g., default gateway). Consequences: man-in-the-middle, packet sniffing, session hijacking, denial of service. Mitigations: static ARP entries, Dynamic ARP Inspection, port security, monitoring with ARPwatch, encryption for sensitive data.
Homework 3: Compare and contrast ARP with IPv6 Neighbor Discovery Protocol (NDP). Discuss the similarities and differences in address resolution, message types, and security features.
Similarities: both resolve IP addresses to link-layer addresses. Differences: NDP uses ICMPv6 (Neighbor Solicitation and Neighbor Advertisement) over multicast; ARP uses broadcast. NDP includes router discovery and duplicate address detection; ARP does not. NDP has security extensions (SEND) using digital signatures to prevent spoofing; ARP is inherently insecure. NDP is more efficient and integrated with IPv6.
Homework 4: A network administrator notices that hosts on a VLAN are experiencing intermittent connectivity. ARP requests are not being answered. What could be the possible causes? How would you troubleshoot?
Possible causes: misconfigured IP addresses, duplicate IPs, ARP cache poisoning, broadcast storm, VLAN misconfiguration, or switches blocking ARP broadcasts (e.g., storm control). Troubleshooting: check ARP cache on affected hosts, ping the gateway, use packet capture to see if ARP requests are sent and received, check switch logs for errors, verify VLAN settings, and ensure no ACLs are blocking ARP.
Homework 5: Explain the purpose of gratuitous ARP. Provide a scenario where it is useful and a scenario where it can be malicious.
Gratuitous ARP is used to announce an IP-MAC mapping. Useful scenarios: updating switches after a device changes its MAC (e.g., new NIC), announcing a new IP address (DHCP), or detecting IP conflicts. Malicious scenario: an attacker can send gratuitous ARP replies to redirect traffic (ARP spoofing) by claiming the MAC of the gateway.
Homework 6: In a network where proxy ARP is enabled on a router, what happens when a host sends an ARP request for an IP address on a different subnet? What are the advantages and disadvantages of using proxy ARP?
The router responds with its own MAC address, allowing the host to communicate with the destination as if it were local. Advantages: simple for hosts, no need for host routing configuration. Disadvantages: can cause confusion, security risks (hosts might think destinations are local), and can lead to routing loops if not configured properly. Also, proxy ARP can be used for man-in-the-middle attacks.
Homework 7: What is the difference between a dynamic and a static ARP entry? When would you use each? Provide examples.
Dynamic entries are learned via ARP and expire after a timeout. Static entries are manually configured and persist forever. Use dynamic for most hosts; static for critical devices like routers and servers to prevent spoofing. Example: static entry for default gateway IP to MAC ensures no poisoning.
Homework 8: Explain how a switch's CAM table and ARP cache interact when a host sends a unicast frame to another host on the same VLAN.
Host A sends an ARP request (broadcast) to learn Host B's MAC. The switch floods the broadcast to all ports. Host B replies (unicast) with its MAC; the switch learns B's MAC-to-port mapping in its CAM table. Later, when A sends a unicast frame to B, the switch looks up B's MAC in its CAM and forwards only to that port.
Homework 9: Describe a scenario where ARP can be used as a Denial-of-Service (DoS) attack. How would you mitigate it?
An attacker can send a large number of forged ARP replies to exhaust the ARP cache of a target host or switch, or flood the network with ARP requests. This can cause the target to drop legitimate traffic. Mitigation: rate limiting ARP packets on switches, using ARP inspection, and setting ARP cache timeouts appropriately.
Homework 10: What is the role of the "hardware address length" and "protocol address length" fields in an ARP packet? Why are they necessary?
They specify the number of bytes for the hardware address (e.g., 6 for Ethernet MAC) and protocol address (4 for IPv4). This makes ARP flexible to support different network technologies and protocols. They allow the receiver to parse the packet correctly.
Homework 11: In a switched network, if a host sends an ARP request for an IP that is not in its subnet, what happens? Does it get a reply?
The host will not send an ARP request for an off-subnet IP; it will send the packet to its default gateway. It will first ARP for the gateway's MAC. If it does send an ARP request for an off-subnet IP (which is not recommended), it would be broadcast, but no host on the local subnet would respond unless proxy ARP is enabled. With proxy ARP, the router may reply with its own MAC.
Homework 12: What is the significance of the "Type" field in the ARP cache (e.g., static vs dynamic)? How does the operating system treat them differently?
The Type indicates whether the entry is static (manually added) or dynamic (learned). The OS treats static entries as permanent; they are not subject to timeout and are used even if they are incorrect. Dynamic entries have a timeout and can be overwritten by new ARP packets.
Homework 13: Compare ARP broadcasts to IPv6 Neighbor Solicitation messages. Why is multicast preferred over broadcast?
ARP uses broadcast, which interrupts all hosts on the LAN, even those not interested. IPv6 NDP uses multicast to a specific solicited-node multicast address, which only a small group of hosts (usually just the target) processes, reducing CPU overhead and network noise.
Homework 14: Describe how a host can use ARP to detect duplicate IP addresses. What are the steps involved?
A host can send an ARP request for its own IP address (gratuitous ARP). If it receives an ARP reply, another host is using that IP. The host should then release the IP and report a conflict. Some DHCP clients also send an ARP probe (request with target IP = its own, but sender IP = 0.0.0.0) to check before using the address.
Homework 15: Explain the concept of "ARP flooding" and how it can be used in network reconnaissance.
ARP flooding involves sending a large number of ARP requests to discover active hosts on a network. By observing ARP replies, an attacker can map IP addresses to MAC addresses and identify which hosts are alive. This is a reconnaissance technique. Mitigation: rate limiting ARP requests on switches, and using VLANs to isolate segments.
This tutorial covered the essential concepts of MAC addressing and the Address Resolution Protocol (ARP):
Understanding ARP is fundamental for network diagnostics and security. In the next tutorial, we will explore Ethernet fundamentals and frame structure.