ARP — address resolution, ARP cache, gratuitous ARP

WHY does ARP even exist?

WHAT happens if there were no ARP? You'd have to manually type the MAC of every machine you talk to. ARP automates this dynamically.

The address-resolution process (HOW it works)

The mechanism is a broadcast request / unicast reply:

A checks its ARP cache. If B's IP→MAC is there, done.
If not, A broadcasts an ARP Request: dest MAC = FF:FF:FF:FF:FF:FF (everyone), asking "Who has 10.0.0.5? Tell 10.0.0.1."
Every host on the LAN sees it; only B (the owner of 10.0.0.5) replies with a unicast ARP Reply: "10.0.0.5 is at AA:BB:CC:DD:EE:FF."
A stores the mapping in its cache and sends the real data frame.

Figure — ARP — address resolution, ARP cache, gratuitous ARP

The ARP cache (WHY keep a table?)

HOW the timeout helps: if B's NIC is swapped or B moves, the stale entry expires and A re-learns the correct MAC. Short timeout = fresher data but more broadcasts; long timeout = fewer broadcasts but slower to notice changes. That's the engineering trade-off.

Gratuitous ARP (the "announcement" ARP)

WHAT it's used for (3 big jobs):

Duplicate IP detection — on boot, a host gratuitous-ARPs its own IP. If someone else replies, there's an IP conflict.
Cache update after a MAC change — e.g. failover: a backup server takes over 10.0.0.5 (Virtual IP) but has a different MAC. It gratuitous-ARPs so every host immediately updates 10.0.0.5 → new MAC instead of waiting for stale entries to expire.
Updating switch MAC tables so frames flow to the new active machine.

The dark side: ARP spoofing

Common Mistakes (Steel-manned)

Flashcards

What problem does ARP solve?

Mapping a known IPv4 (Layer-3) address to the MAC (Layer-2) address needed to deliver an Ethernet frame on the local LAN.

What is the destination MAC of an ARP Request?

The broadcast address FF:FF:FF:FF:FF:FF.

Is the ARP Reply broadcast or unicast, and why?

Unicast — the replier learned the requester's MAC from the request's source field, so no broadcast is needed.

What EtherType identifies ARP?

0x0806.

What is the ARP cache and why does it exist?

A timed table of IP↔MAC mappings; it avoids broadcasting an ARP request for every single packet.

What distinguishes a dynamic from a static ARP entry?

Dynamic entries are learned and expire on a timeout; static entries are manually configured and never expire.

What defines a Gratuitous ARP packet?

An unsolicited ARP where Sender IP == Target IP (a host announcing its own mapping).

Give two uses of gratuitous ARP.

Duplicate-IP detection and updating caches after a MAC change (failover / VIP takeover).

Why can't ARP reach a host on a different network?

ARP is broadcast-based and routers don't forward ARP broadcasts; you ARP for the gateway instead.

What replaces ARP in IPv6?

NDP (Neighbor Discovery Protocol) over ICMPv6.

Why is ARP insecure?

It has no authentication, so forged replies enable ARP spoofing / man-in-the-middle.

Recall Feynman: explain to a 12-year-old

Imagine you want to hand a letter to "Sam" in a big classroom, but you only know his name, not where he sits. You shout to the whole room: "Where is Sam?" (that's the ARP request — everybody hears it). Only Sam raises his hand and says "I'm here, in seat 5!" (the reply). Now you walk straight to seat 5 — and you write it on a sticky note so next time you don't have to shout (that's the cache). A gratuitous ARP is when Sam stands up on his own and announces "Hey everyone, I'm in seat 5 now!" — useful if he just changed seats and wants everyone's sticky notes updated instantly.

Connections

Ethernet & MAC addressing — ARP fills the IP→MAC gap for Layer-2 delivery.
IP addressing & subnetting — host uses the subnet mask to decide local vs remote (ARP target vs gateway).
Default gateway & routing — remote traffic ARPs for the gateway's MAC.
Switching & MAC learning tables — switches learn ports from frame sources; gratuitous ARP refreshes them.
NDP — IPv6 Neighbor Discovery — the IPv6 successor to ARP.
Network security — MITM & ARP spoofing — exploits ARP's lack of authentication.
DHCP — newly assigned hosts often gratuitous-ARP to detect IP conflicts.

Concept Map

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Dekho, har computer ke paas do tarah ke address hote hain: ek IP address (logical, jo internet pe routing ke liye chahiye) aur ek MAC address (physical, jo NIC card pe burned hota hai aur jiske bina LAN pe actual frame deliver hi nahi ho sakta). Problem ye hai ki tumhare paas sirf destination ka IP hota hai, par Ethernet frame bhejne ke liye uska MAC chahiye. Yahin ARP kaam aata hai — ye IP ko MAC me convert kar deta hai, ek phone-book lookup ki tarah.

Process simple hai: Host A apni ARP cache check karta hai. Agar mapping nahi mili, to wo poore LAN pe ek broadcast bhejta hai — "Bhai, 10.0.0.5 kiska hai? Mujhe batao" (destination MAC = FF:FF:FF:FF:FF:FF, matlab sabko). Sirf jiska wo IP hai wahi host unicast reply deta hai — "Wo main hoon, mera MAC ye raha." A use cache me save kar leta hai taaki baar-baar broadcast na karna pade. Cache me entries ka ek timeout hota hai, isliye agar koi MAC change ho jaye to thodi der baad fresh value mil jaati hai.

Gratuitous ARP thoda alag hai — yahan koi puchta nahi, host khud bina maange apna mapping announce kar deta hai (Sender IP == Target IP). Iska bada use failover me hota hai: maan lo ek backup server kisi Virtual IP ko le leta hai, to wo gratuitous ARP bhej kar sabki cache turant update kar deta hai, warna purani stale entry expire hone tak downtime hota. Iske alawa duplicate IP detect karne me bhi kaam aata hai.

Do important baatein yaad rakhna: ARP router ke paar nahi jaata — broadcast routers forward nahi karte, isliye remote host ke liye tum gateway ka MAC resolve karte ho. Aur ARP me koi authentication nahi hai, isliye koi attacker fake reply bhej kar ARP spoofing / MITM kar sakta hai. IPv6 me ARP ki jagah NDP use hota hai. Bas itna clear ho gaya to ye topic pakka ho gaya!