Chapter 6 — ARP: finding your neighbour

In one sentence

Before your machine can send a frame, it must translate the next hop's IP address into a MAC address — and it does that by shouting a question to everyone on the local network.

The problem

You want to reach 192.168.1.1 (your router). You know its IP. But to build an Ethernet frame you need its MAC. You've never spoken to it before. How do you find out?

The idea, in plain language

Shout.

YOU (to everyone on the network):
    "Who has 192.168.1.1? Tell 192.168.1.50!"

EVERYONE ELSE:  ...not me... not me... not me...

THE ROUTER (directly back to you):
    "192.168.1.1 is at bb:bb:bb:bb:bb:bb"

YOU: *writes it down in a notebook so you don't have to ask again*

That's ARP — Address Resolution Protocol. The notebook is the ARP cache.

How it actually works

1. Your machine checks its ARP cache. Got 192.168.1.1? Use it, done.

2. Cache miss -> build an ARP REQUEST and send it to the BROADCAST MAC
   (ff:ff:ff:ff:ff:ff), so every device on the segment receives it.

      "Who has 192.168.1.1?  Tell 192.168.1.50 (aa:aa:aa:aa:aa:aa)"

3. Every device looks at it. Devices whose IP doesn't match ignore it.

4. The matching device sends an ARP REPLY -- UNICAST, straight back to you:

      "192.168.1.1 is at bb:bb:bb:bb:bb:bb"

5. You cache it (typically for tens of seconds to a few minutes) and now you can
   build frames.

Two important details:

ARP frames are not IP packets. They have EtherType 0x0806, no IP header, no TTL. They cannot cross a router. ARP only works within one local network.
ARP has no security whatsoever. Any device can reply "that IP is at my MAC" and be believed. That's ARP spoofing — the classic local-network attack (Chapter 38).

The "am I local?" decision (important!)

Before ARPing, your machine asks: is this destination on my own network, or do I need the router?

Your address:      192.168.1.50 / 24     ("/24" explained in Chapter 10)
Your network is:   192.168.1.*

Sending to 192.168.1.99?
   -> same network -> ARP for 192.168.1.99 itself, send directly

Sending to 93.184.216.34?
   -> different network -> ARP for the GATEWAY (192.168.1.1), send there
      (the packet's destination IP is still 93.184.216.34 -- only the frame
       is addressed to the router)

This decision is why subnet masks matter, and it's the bridge into Chapter 10.

Worked example: watch it happen live

# 1. Look at your current ARP cache
ip neigh                    # Linux
arp -a                      # macOS / Linux / Windows

# 2. Clear one entry so you can watch it be rebuilt (Linux)
sudo ip neigh flush all

# 3. In one terminal, start watching for ARP:
sudo tcpdump -i any -n arp

# 4. In another terminal, ping your router (use YOUR gateway address)
ping -c 2 192.168.1.1

In the tcpdump window you'll see exactly this:

ARP, Request who-has 192.168.1.1 tell 192.168.1.50, length 28
ARP, Reply 192.168.1.1 is-at bb:bb:bb:bb:bb:bb, length 46

That is one of the most satisfying things in this guide. You just watched a protocol from 1982 (RFC 826) work in front of you.

The ARP cache states (Linux)

ip neigh
192.168.1.1 dev wlan0 lladdr bb:bb:bb:bb:bb:bb REACHABLE
192.168.1.99 dev wlan0 lladdr cc:cc:cc:cc:cc:cc STALE

State	Meaning
`REACHABLE`	Confirmed recently — use it
`STALE`	Probably still fine; will be re-verified on next use
`DELAY` / `PROBE`	Currently re-checking
`FAILED`	No answer — the device is gone or not responding
`PERMANENT`	Manually pinned, never expires

Practice (25 min)

Run the live capture above. Save the output in notes.md.
ip neigh (or arp -a) — how many neighbours does your machine know? Can you identify them (router, printer, phone, TV)?
Ping a device on your network that's turned off. Watch tcpdump: you'll see ARP requests repeated with no reply, and ping reports "Destination Host Unreachable". That error means ARP failed — the machine isn't there. This is a genuinely useful diagnostic to recognise.
Ping a device on the internet and watch ARP. You'll see... nothing new, because your router's MAC is already cached. Flush the cache and try again.

Common confusions

"Why not just use MAC addresses for everything?" Because they're flat. A router would need a table with every MAC address on Earth. IP addresses are hierarchical (Chapter 9), so a router can say "everything starting with 93.184 goes that way" in one line.
"Why not just use IP for everything?" Because the physical network only understands MACs. IP is a fiction layered on top; ARP is the glue.
"Does IPv6 use ARP?" No — it uses NDP (Neighbor Discovery Protocol), which does the same job using ICMPv6 messages. Chapter 16.
"Destination Host Unreachable vs Request Timed Out?" Host Unreachable usually means ARP failed on the last hop (device absent). Timed out means the packet went somewhere and nothing came back. Different problems.

Check yourself

What does ARP translate, and in which direction?
Why is an ARP request sent to the broadcast address but the reply sent directly?
Can an ARP request cross a router? Why or why not?
When you browse the web, whose MAC does your laptop ARP for?