What is ARP (Address Resolution Protocol)?
Learn what ARP is, how it resolves IP addresses to MAC addresses, and ARP spoofing risks — with networking interview questions answered.
Expected Interview Answer
ARP (Address Resolution Protocol) maps a known IP address to its corresponding MAC address on a local network, allowing a device to discover the physical hardware address it needs to actually deliver an Ethernet frame to a neighbor.
When a device wants to send a packet to another host on the same LAN, it knows the destination IP address but needs the destination MAC address to build the Ethernet frame. It broadcasts an ARP request ("who has this IP?") to every device on the segment; the device that owns that IP replies directly with an ARP reply containing its MAC address, which the sender then caches in its ARP table for future use. This avoids broadcasting every subsequent packet and speeds up local delivery. ARP only works within a single broadcast domain — to reach hosts on another network, a device instead resolves the MAC address of its default gateway and lets routing handle the rest. Because ARP replies are trusted without authentication, ARP spoofing/poisoning is a well-known attack where a malicious host claims someone else’s IP to intercept traffic.
- Bridges Layer 3 IP addressing to Layer 2 MAC delivery
- Caches resolved mappings to avoid repeated broadcasts
- Enables efficient local (same-subnet) frame delivery
- Underpins default-gateway resolution for off-subnet traffic
AI Mentor Explanation
ARP is like a fielder shouting across the ground "who is standing at position number 4?" when they only know the fielding position but not which player is there — whoever occupies that position calls back "that is me, here is my name" so the ball can be thrown directly to them next time. The fielder remembers the name for the rest of the over instead of shouting again every ball. This broadcast-then-remember pattern is exactly how ARP resolves an IP address to a MAC address.
Step-by-Step Explanation
Step 1
ARP request
The sender broadcasts "who has IP X?" to every device on the local network segment.
Step 2
ARP reply
The device owning that IP replies directly with its MAC address.
Step 3
Cache the mapping
The sender stores the IP-to-MAC mapping in its local ARP cache/table.
Step 4
Frame delivery
Subsequent packets to that IP use the cached MAC address without another broadcast.
What Interviewer Expects
- Correct definition: resolves IP address to MAC address on a LAN
- Understands the broadcast request / unicast reply mechanism
- Knows ARP is confined to a single broadcast domain (subnet)
- Aware of ARP spoofing/poisoning as a security concern
Common Mistakes
- Confusing ARP with DNS (ARP is IP-to-MAC, not name-to-IP)
- Thinking ARP works across different networks/subnets
- Not knowing ARP replies are unauthenticated, enabling spoofing
- Forgetting that resolved mappings are cached, not looked up every time
Best Answer (HR Friendly)
“ARP is how a device on your local network finds the physical hardware address of another device when it only knows its IP address. It shouts out "who has this address?" on the network, the right device answers back, and that answer gets remembered so future messages go straight there without asking again.”
Code Example
# View the current ARP cache (IP -> MAC mappings)
arp -a
# Force an ARP resolution by pinging a local host
ping -c 1 192.168.1.5
arp -n 192.168.1.5
# 192.168.1.5 ether 00:1a:2b:3c:4d:5e C eth0Follow-up Questions
- What is ARP spoofing/poisoning and how can it be mitigated?
- How does ARP differ from Reverse ARP (RARP)?
- Why does ARP not work across different subnets?
- How does gratuitous ARP work and when is it used?
MCQ Practice
1. What does ARP resolve?
ARP maps a known IP address to the MAC address of the device that owns it on the local network.
2. How does a device send an initial ARP request?
The ARP request is broadcast to every device on the local network segment.
3. ARP resolution is limited to what scope?
ARP only works within one local broadcast domain (subnet); routing handles cross-network delivery.
Flash Cards
What is ARP? — A protocol that resolves a known IP address to its MAC address on a local network.
ARP request type? — Broadcast to the local segment ("who has this IP?").
ARP reply type? — Unicast directly back to the requester with the owner’s MAC address.
ARP security risk? — ARP spoofing/poisoning — replies are unauthenticated and can be forged.