ARP: Mapping IPs to MACs

1. Why We Need ARP: Bridging Layers 2 and 3

To understand ARP's role, we need to think about how data is prepared for sending, a process called encapsulation. When your computer sends data, it moves down the layers of the network model:

• At Layer 3 (Network Layer), it creates an IP packet, which includes the source IP and the destination IP. This is like putting a letter in an envelope and writing the full mailing address.
• At Layer 2 (Data Link Layer), it wraps that IP packet into an Ethernet frame. This frame needs a source MAC address and a destination MAC address. This is like handing the envelope to a specific mail carrier who operates on a local route.

Your computer knows its own IP and MAC, and it knows the destination IP. The missing piece is the destination MAC address for a device on the same local network. ARP was designed to solve exactly this problem.

2. The ARP Process: A Request and a Reply

So, how does a device find a MAC address it doesn't know? It asks. The ARP process is a simple, two-step conversation that happens on your local network.

1. ARP Request (Broadcast): Your computer sends a special message to every device on the local network. This is a broadcast. The message essentially shouts, "I'm looking for the device using IP address 192.168.1.1. If that's you, please tell me your MAC address."
2. ARP Reply (Unicast): The other devices on the network see this message, but ignore it if the IP address isn't theirs. The one device that owns the target IP address (e.g., your router at 192.168.1.1) sends a reply directly back to your computer. This is a unicast message. It says, "I have IP address 192.168.1.1, and my MAC address is E0:B9:A5:12:34:56."

Now your computer has the MAC address it needs, completes the Ethernet frame, and sends the data.

The following video provides a clear, animated explanation of this process.

This diagram also visualizes the process, showing the request being broadcast and the reply being sent directly back.

3. Making it Efficient: The ARP Cache

Broadcasting a request for every single packet would create a lot of unnecessary network traffic. To avoid this, operating systems maintain a temporary storage for these mappings called the ARP cache or ARP table.

When your computer gets an ARP reply, it stores the IP-to-MAC address mapping in this cache. The next time it needs to send data to that same IP address, it first checks its cache. If the entry is there, it can use the stored MAC address immediately without needing to perform another ARP request.

These entries don't last forever; they typically expire after a few minutes to ensure the information stays fresh in case a device's IP address changes or it leaves the network.

4. Hands-On: Exploring Your System's ARP Cache

Let's put this theory into practice on your Arch Linux system. You can view your system's ARP cache using the command line. While the older arp -a command works, the modern tool from the iproute2 suite is ip neigh.

Open your terminal and let's explore:

1. View your current ARP cache:

   ip neigh show
   

   You will see a list of IP addresses on your local network that your computer has recently communicated with, along with their corresponding MAC addresses and the state of the entry (e.g., REACHABLE, STALE).

2. Generate a new ARP entry:

   • Pick an IP address from the output that is marked as STALE or FAILED, or find another device on your network (like your phone) whose IP you know.
   • If you need to find your router's IP, you can use: ip route show default
   • Now, try to communicate with it using ping. We only need to send one packet.

   
   
   
   # Replace 192.168.1.1 with your router's IP or another device's IP
   ping -c 1 192.168.1.1
   

   If the device's entry wasn't in your cache or was stale, your system just performed an ARP request to get its MAC address before sending the ping request.

3. View the updated cache:

   ip neigh show
   

   You should now see a fresh, REACHABLE entry for the IP address you just pinged.

The CertBros video you watched earlier demonstrates a similar process using arp -d to delete an entry and ping to regenerate it. While the video uses PowerShell on Windows, the underlying networking principle you just performed is identical.

5. The Hacker's Angle: ARP Spoofing

ARP is fundamentally built on trust. It assumes that the device replying to an ARP request is honest. This trust can be exploited.

ARP spoofing, also known as ARP cache poisoning, is an attack where a malicious actor on the local network sends forged ARP replies. For example, an attacker can send an ARP reply to your computer claiming that their MAC address corresponds to the IP address of the network's default gateway (your router).

If your computer accepts this fake reply, it updates its ARP cache with the attacker's MAC address for the gateway's IP. From that point on, all the traffic you think you're sending to the internet via your router is actually being sent to the attacker's machine first. This places the attacker in a "Man-in-the-Middle" (MITM) position, allowing them to intercept, inspect, or modify all of your outbound traffic.

This is one of the classic attacks performed on local networks and a fundamental concept in penetration testing.

Conclusion

In this lesson, you've learned how devices on a local network solve the critical problem of translating logical IP addresses into physical MAC addresses. This is a fundamental building block of how networks function at a low level.

Key Takeaways:

• Purpose: ARP's job is to discover the MAC address associated with a specific IP address on a local network.
• Mechanism: It uses a broadcast ARP Request ("Who has this IP?") and a unicast ARP Reply ("I have that IP, here's my MAC").
• Efficiency: The ARP cache stores recent mappings to avoid constant, noisy broadcast requests.
• Practical Tool: On Linux, you can inspect the ARP cache with the ip neigh show command.
• Security Risk: Because ARP is based on trust, it is vulnerable to ARP spoofing, which can lead to Man-in-the-Middle attacks.

Next Lesson Preview:
We've seen how devices communicate once they have IP addresses. But in most networks, you don't manually assign an IP address to your computer, phone, or every other device. They get one automatically when they join the network. How does this happen? In our next lesson, we will explore the Dynamic Host Configuration Protocol (DHCP), the system that automates IP address assignment.