Address Resolution Protocol (ARP) plays a vital role in IPv4 networking by enabling devices on the same local subnet to discover the MAC address associated with a given IP address. This mapping is essential for enabling Layer 3 (IP) communication over Layer 2 (Ethernet) networks.

• Translates IP addresses to MAC addresses within a local network.

• Required for direct communication on the same subnet (e.g., sending an Ethernet frame).

• Used by routers, switches, and hosts to correctly address frames.

  

ARP Communication Flow

1. ARP Request (Broadcast)

   • A host that wants to know the MAC address of a known IP address sends a broadcast frame:

     Who has 192.168.1.10? Tell 192.168.1.1
     

   • This request is sent to the broadcast MAC: FF:FF:FF:FF:FF:FF.

2. ARP Reply (Unicast)

   • The device with the requested IP replies directly to the requester with its MAC address:

     192.168.1.10 is at 00:0c:29:aa:bb:cc
     

3. Caching

   • The IP-to-MAC mapping is stored in the sender’s ARP cache for a short duration to avoid repeated broadcasts.

     

Security

Despite its utility, ARP is inherently insecure:

• No Authentication: Devices accept unsolicited replies and update their ARP cache without verification.
• Stateless Design: There’s no mechanism to track requests and validate responses.
• Cache Poisoning Risk: An attacker can send false ARP replies to poison the cache of a target.

These weaknesses can be exploited in attacks like:

• Man-in-the-Middle (MITM): Attacker poisons the ARP cache to intercept traffic between two legitimate hosts.
• Impersonation: Malicious devices can claim to own the IP of another host or router.