---

Address Resolution Protocol (ARP)

---

1. Purpose of ARP

In computer networks, logical (IP) addresses and physical (MAC) addresses operate at different architectural layers:

• IP Address (Layer 3): Used for global routing across internetworks.
• MAC Address (Layer 2): Required by hardware network adapters (NICs) to deliver frames across the physical medium.

The Address Resolution Protocol (ARP) (RFC 826) dynamically maps a known Layer 3 Logical IP address to an unknown Layer 2 Physical MAC address on the local broadcast domain.

---

2. The ARP Process: Request and Reply

Step 1: ARP Request (Broadcast)

• The sender creates an ARP request packet asking: "Who has IP 192.168.1.50? Tell 192.168.1.10."
• Encapsulated inside an Ethernet frame with Broadcast Destination MAC FF:FF:FF:FF:FF:FF.
• Every host on the local physical switch port receives and processes the frame. All hosts whose IP does not match silently drop it.

Step 2: ARP Reply (Unicast)

• The target host recognizing its own IP address updates its local ARP table with the sender's details.
• It formulates an ARP Reply: "I have 192.168.1.50, my MAC is BB:BB:BB:BB:BB:BB."
• Sent back as a Unicast Frame directly to the sender's MAC address.

---

3. ARP Cache and Aging

To avoid broadcasting an ARP request for every single outbound packet, each computer maintains an in-memory ARP Cache (Table):

  ARP Cache Table:
  Internet Address      Physical (MAC) Address     Type        TTL (Expiry)
  192.168.1.1           00-14-22-01-23-45          Dynamic     15 min
  192.168.1.50          bb-bb-bb-bb-bb-bb          Dynamic     18 min
  192.168.1.255         ff-ff-ff-ff-ff-ff          Static      Permanent

• Dynamic Entries: Learned automatically via ARP replies. Associated with an Aging Timer (typically $15 - 20\text{ minutes}$) to remove outdated entries if network adapters change.
• Static Entries: Manually added by network administrators for permanent servers.

---

4. Special ARP Variants

A. Proxy ARP

• A router configured with Proxy ARP answers ARP requests on behalf of a host that resides on a remote network or different subnet.
• The router replies with its own MAC address, tricking the local sender into sending traffic to the router, which then forwards the packets across subnets.

B. Gratuitous ARP

• An unsolicited ARP broadcast where a host announces its own mapping:
  • $\text{Sender IP} = \text{Target IP} = \text{Own IP}$.
• Uses:
  1. Duplicate IP Detection: If any node responds to the gratuitous ARP, an IP conflict exists on the LAN.
  2. Cache Update: Informs switches and gateway routers of a MAC address change (e.g., failover in High Availability clusters).

C. ARP Spoofing / Poisoning (Security Vulnerability)

• Because ARP has no authentication, an attacker can broadcast fake ARP replies claiming their MAC address belongs to the Default Gateway.
• All local traffic is redirected to the attacker's machine, enabling Man-in-the-Middle (MitM) attacks.
• Mitigation: Dynamic ARP Inspection (DAI) on managed enterprise switches.

---

5. ARP Packet Format

---