Address Resolution Protocol (ARP) is used on a local network to determine the link-layer (MAC) address corresponding to a known IP address.
The key problem ARP solves is:
IP address → MAC address
For Ethernet communication, knowing only the destination IP address is not enough. The sender must also know the destination MAC address so that it can construct the Ethernet frame.
IP packet
|
v
Need destination MAC
|
v
ARP
|
v
IP address → MAC address
|
v
Ethernet frame
Primary source: James F. Kurose and Keith W. Ross, Computer Networking: A Top-Down Approach, 8th ed., Chapter 6, §6.4.1 — Link-Layer Addressing and ARP, p. 478.
2. Why Do We Need ARP?
There are two different addressing systems involved in communication on an Ethernet LAN:
Network layer:
IP address
Link layer:
MAC address
Suppose host A wants to send an IP datagram to host B.
Host A
IP = 192.168.1.10
MAC = AA:AA:AA:AA:AA:AA
|
| IP datagram destined for
| 192.168.1.20
v
Host B
IP = 192.168.1.20
MAC = BB:BB:BB:BB:BB:BB
A knows B's IP address, but the Ethernet adapter needs B's MAC address to construct the link-layer frame.
ARP performs this translation:
192.168.1.20
|
| ARP
v
BB:BB:BB:BB:BB:BB
Source: Kurose & Ross, 8th ed., §6.4.1 — Link-Layer Addressing and ARP, p. 478.
3. ARP Table / ARP Cache
Each IP node on a LAN maintains an ARP table containing IP-to-MAC mappings for nearby nodes.
Conceptually:
+----------------+----------------------+----------+
| IP Address | MAC Address | TTL |
+----------------+----------------------+----------+
| 192.168.1.20 | BB:BB:BB:BB:BB:BB | ... |
| 192.168.1.30 | CC:CC:CC:CC:CC:CC | ... |
+----------------+----------------------+----------+
Kurose & Ross describes an ARP table entry as:
< IP address ; MAC address ; TTL >
The TTL indicates how long the mapping can remain before it is forgotten.
This is called soft state because the information disappears after it becomes stale unless it is refreshed.
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
4. Basic ARP Operation
Consider host A sending to host B on the same LAN.
Assume A knows B's IP address but does not currently have B's MAC address in its ARP table.
Step 1 — ARP Request
A broadcasts an ARP query containing B's IP address.
The Ethernet destination MAC address is:
FF:FF:FF:FF:FF:FF
which is the Ethernet broadcast address.
Host A
|
| ARP Request
| "Who has 192.168.1.20?"
| Destination MAC = FF:FF:FF:FF:FF:FF
v
================ LAN ================
| | |
Host B Host C Host D
Because the request is broadcast, all nodes on the LAN receive it.
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
5. Step 2 — ARP Reply
Host B recognizes that the requested IP address belongs to it.
It responds with its MAC address.
Host A Host B
| |
| ----- ARP Request ---------> |
| Who has IP B? |
| |
| <---- ARP Reply ------------ |
| IP B = MAC B |
| |
The reply is sent as a unicast Ethernet frame to A's MAC address.
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
6. Step 3 — Cache the Mapping
After receiving the ARP reply, A saves the mapping in its ARP table.
Before:
192.168.1.20 → unknown
After ARP:
192.168.1.20 → BB:BB:BB:BB:BB:BB
A can now construct Ethernet frames addressed to B's MAC address.
+----------------+----------------+------------------+
| Ethernet Header| IP Header | Application Data |
+----------------+----------------+------------------+
^
|
Destination MAC = B's MAC
The mapping remains cached until it becomes stale and times out.
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
7. ARP Is a Local-LAN Protocol
ARP resolves a destination's link-layer address on the local network.
If A wants to communicate with a host on another network, A does not normally ARP for the remote host's MAC address.
Instead, A sends the Ethernet frame to the MAC address of its next-hop router/default gateway.
Conceptually:
Host A Router Remote Host
| | |
| Ethernet frame | |
| Destination MAC = Router | |
|--------------------------->| |
| | IP packet |
| |----------------------------->|
ARP is therefore used to resolve the MAC address of the local next hop.
Source: Kurose & Ross, 8th ed., §6.4.1 — Link-Layer Addressing and ARP.
8. ARP Request vs ARP Reply
| Feature | ARP Request | ARP Reply |
|---|---|---|
| Purpose | Ask for MAC corresponding to an IP | Provide the MAC address |
| Ethernet destination | Broadcast | Normally unicast |
| Example | "Who has IP B?" | "IP B is at MAC B" |
| Result | Target learns requester's information as part of normal processing; requested mapping is sought | Sender can cache the IP-to-MAC mapping |
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
9. ARP Packet Structure
ARP itself is carried in a link-layer frame rather than being carried inside an IP packet.
A conceptual Ethernet + ARP exchange is:
Ethernet Frame
+------------------------------------------------+
| Ethernet Header |
+------------------------------------------------+
| ARP Message |
| |
| Sender IP |
| Sender MAC |
| Target IP |
| Target MAC |
+------------------------------------------------+
Nmap's ARP scanning documentation demonstrates ARP requests being sent directly at the Ethernet level, including examples with the broadcast destination:
ARP Who has <target IP>?
Destination MAC = ff:ff:ff:ff:ff:ff
Source: Gordon Lyon, Nmap Network Scanning, Chapter 3 — Host Discovery Techniques, ARP Scan (-PR); this section explains that ARP is the default scan method for hosts on the same Ethernet LAN because the OS needs the destination hardware address to construct the Ethernet frame.
10. ARP and Ethernet
ARP becomes necessary because IP and Ethernet use different addressing schemes.
Network Layer
-------------
IP Address
|
| ARP
v
MAC Address
-------------
Link Layer
The process is therefore:
Destination IP
|
v
Check ARP cache
|
+------ mapping exists ------> use MAC
|
+------ mapping missing -----> ARP request
|
v
ARP reply
|
v
cache mapping
|
v
send Ethernet
Source: Kurose & Ross, 8th ed., §6.4.1.
11. ARP as "Plug-and-Play"
Kurose & Ross describes ARP as plug-and-play because nodes can create their ARP tables without intervention from a network administrator.
A host can dynamically discover the MAC address corresponding to an IP address when it needs to communicate.
Need MAC
↓
ARP request
↓
ARP reply
↓
Cache mapping
↓
Communicate
Source: Kurose & Ross, 8th ed., §6.4.1, p. 478.
12. Why ARP Has a Security Problem
ARP performs a critical function but was designed without authentication of ARP messages.
Wenliang Du describes ARP as a simple protocol that does not implement security measures.
This means a host can be fooled into accepting a forged IP-to-MAC mapping.
Example of a legitimate mapping:
192.168.1.20 → BB:BB:BB:BB:BB:BB
An attacker may attempt to make the victim associate the same IP with the attacker's MAC:
192.168.1.20 → MM:MM:MM:MM:MM:MM
If accepted, packets intended for B can instead be sent to the attacker's machine.
Primary source: Wenliang Du, Computer & Internet Security: A Hands-on Approach, 2nd ed., material on ARP Cache Poisoning Attack / SEED ARP Attack Lab.
13. ARP Cache Poisoning
ARP cache poisoning is the attack in which an attacker causes a victim to accept a forged IP-to-MAC mapping.
The fundamental attack is:
Correct:
Victim's ARP cache
|
v
IP of B → MAC of B
↓ attack
Poisoned:
Victim's ARP cache
|
v
IP of B → MAC of Attacker
The victim now sends Ethernet frames intended for B to the attacker's MAC address.
Du explains that this can redirect the victim's packets to the machine associated with the forged MAC address.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview and Task 1.
14. Attack Vector: Forged ARP Information
The attack exploits the lack of authentication in ARP.
Conceptually:
Legitimate LAN
Victim A Victim B
| |
| |
+------------+--------------+
|
Attacker
The attacker sends forged ARP information intended to cause hosts to associate an IP address with the attacker's MAC address.
The victim may then update its ARP cache:
IP(B) → MAC(Attacker)
instead of:
IP(B) → MAC(B)
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview and Task 1.
15. ARP Cache Poisoning and Man-in-the-Middle
One major consequence is a Man-in-the-Middle (MITM) attack.
Suppose A and B normally communicate directly:
A <-----------------------> B
After ARP poisoning:
A <----------> Attacker <----------> B
The attacker can potentially receive traffic intended for the other host and, depending on the network configuration and attack setup, observe or modify packets before forwarding them.
Du explicitly uses ARP cache poisoning to create a MITM position between two victims A and B.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview and Task 1.
16. How the MITM Position Is Created
Conceptually, the attacker wants both victims to associate the other victim's IP address with the attacker's MAC address.
Victim A's cache:
IP(B) → MAC(Attacker)
Victim B's cache:
IP(A) → MAC(Attacker)
Then traffic becomes:
A
|
| Ethernet frame
| Destination MAC = Attacker
v
Attacker
|
| forwards traffic
v
B
and the reverse direction similarly passes through the attacker.
A <====> Attacker <====> B
^
|
MITM
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Task 1.
17. What Exactly Is Poisoned?
The attack does not directly modify the victim's IP address.
The attacker targets the victim's ARP cache.
IP address
↓
ARP cache
↓
MAC address
↓
Ethernet destination
Poisoning the middle mapping changes where the Ethernet frame is delivered.
Correct:
IP B
↓
ARP
↓
MAC B
↓
Ethernet → B
Poisoned:
IP B
↓
ARP cache
↓
MAC Attacker
↓
Ethernet → Attacker
This is the fundamental mechanism behind ARP cache poisoning.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview.
18. Why the Attack Is Limited to a LAN
ARP operates at the local link layer.
Du's ARP cache poisoning lab specifically requires the attacker and the two victim hosts to be on the same LAN.
Conceptually:
Same LAN
+--------------------------------------+
| |
| Host A ---- Attacker ---- Host B |
| |
+--------------------------------------+
The attacker is manipulating local IP-to-MAC mappings used for Ethernet delivery on that LAN.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, environment/setup section.
19. ARP Cache Poisoning Is Not the Same as IP Spoofing
These are different concepts.
IP spoofing
The attacker forges the source IP address in an IP packet.
IP packet:
Source IP = forged address
ARP cache poisoning
The attacker causes a host to associate an IP address with a forged MAC address.
ARP cache:
IP address → attacker's MAC
The resulting attack occurs at different layers:
IP spoofing
↓
Network layer
ARP poisoning
↓
Link-layer address resolution
The ARP cache poisoning attack described by Du specifically concerns forged IP-to-MAC mappings.
20. Why a Forged Mapping Is Powerful
Suppose B has:
IP(B) = 192.168.1.20
MAC(B) = BB:BB:BB:BB:BB:BB
A victim wants to send data to:
192.168.1.20
The victim eventually constructs:
Ethernet destination MAC
↓
BB:BB:BB:BB:BB:BB
After poisoning:
192.168.1.20
↓
MM:MM:MM:MM:MM:MM
The Ethernet frame is now addressed to the attacker's interface.
Therefore the attack changes the link-layer path taken by traffic without necessarily changing the IP packet's destination IP.
21. Passive vs Active Consequences
ARP poisoning can enable more than simply observing traffic.
Du's ARP cache poisoning lab describes the attacker as being able to:
- Intercept packets
- Modify packets
- Act as a Man-in-the-Middle
Conceptually:
A
|
| packet
v
Attacker
|
| inspect / modify / forward
v
B
This makes ARP poisoning particularly dangerous on an untrusted LAN.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview and Task 1.
22. ARP and Network Switching
ARP determines the MAC address that a host places in the Ethernet frame.
The Ethernet switch then uses MAC-address information to forward the frame within the LAN.
Conceptually:
ARP
|
v
Destination MAC
|
v
Ethernet frame
|
v
Switch
|
v
Destination host
Therefore ARP sits at the boundary between:
IP addressing
↓
MAC addressing
↓
Ethernet forwarding
Sources: Kurose & Ross, 8th ed., §6.4.1 Link-Layer Addressing and ARP and §6.4.2 Ethernet.
23. ARP in a Real Packet Path
Suppose a host wants to send an IP packet on the same LAN.
Application
↓
TCP / UDP
↓
IP packet
↓
Need next-hop MAC
↓
ARP cache lookup
|
+---- Found ----> use cached MAC
|
+---- Missing --> ARP request
↓
ARP reply
↓
cache mapping
↓
Ethernet frame
↓
Switch
↓
Destination
The important point is that ARP is not involved in every packet transmission. Once a mapping is cached, the host can use the cached mapping until it expires or changes.
Source: Kurose & Ross, 8th ed., §6.4.1.
24. Nmap's View of ARP
Nmap's local-LAN host discovery uses ARP because an Ethernet host needs the destination hardware address in order to send the Ethernet frame.
The official Nmap documentation explains that when Nmap scans an Ethernet LAN, ARP is normally the default scan type for local targets.
Example from the Nmap documentation:
00:01:29:f5:27:f2 -> ff:ff:ff:ff:ff:ff
ARP Who has <target IP>?
Nmap also notes that ARP scans are generally more efficient and accurate for local Ethernet hosts because hosts usually cannot simply ignore ARP while still communicating normally on the LAN.
Source: Gordon Lyon, Nmap Network Scanning, Chapter 3 — Host Discovery Techniques, ARP Scan (-PR).
25. ARP Security Weakness — Core Reason
The core security problem can be summarized as:
ARP:
"This IP address is at this MAC address."
↓
Host accepts mapping
↓
Uses mapping for Ethernet delivery
There is no authentication mechanism in the basic ARP protocol described by Du.
Therefore a malicious host can attempt to introduce:
False IP-to-MAC mappings
into a victim's ARP cache.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview.
26. Attack Flow — High Level
The entire attack can be understood as:
ATTACKER
|
| forged ARP information
v
+------------+
| Victim ARP |
| Cache |
+------------+
|
| poisoned mapping
v
IP(B) → MAC(Attacker)
|
v
Ethernet frames
|
v
ATTACKER
|
| forward / modify
v
B
This can put the attacker in a Man-in-the-Middle position.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab, Overview and Task 1.
27. Important Distinction: ARP Request vs Poisoning
Normal ARP:
A → Broadcast:
"Who has IP B?"
B → A:
"IP B is at MAC B"
ARP poisoning:
Attacker → Victim:
"IP B is at MAC Attacker"
The second message is dangerous because it attempts to make the victim's ARP state incorrect.
The security problem comes from the victim trusting the forged mapping.
Source: Wenliang Du, ARP Cache Poisoning Attack Lab.
28. Key Fields / Concepts to Know
| Concept | What it means |
|---|---|
| IP address | Network-layer address |
| MAC address | Link-layer address used for LAN delivery |
| ARP table/cache | Stored IP-to-MAC mappings |
| ARP request | Broadcast query asking who owns an IP address |
| ARP reply | Response providing the MAC address |
| Broadcast MAC | FF:FF:FF:FF:FF:FF |
| Soft state | Cached mapping eventually expires |
| ARP poisoning | Forged IP-to-MAC mapping inserted/accepted by a victim |
| MITM | Attacker positions itself between two communicating hosts |
29. ARP Attack Vector — What Is Actually Being Exploited?
The vulnerability is not that Ethernet or IP addressing is inherently broken.
The weakness is the trust model of ARP:
ARP message
↓
IP-to-MAC mapping
↓
Victim accepts mapping
↓
Future Ethernet frames use mapping
An attacker who can successfully influence that mapping can influence where local Ethernet frames are delivered.
Therefore:
ARP trust
↓
Forged mapping
↓
Wrong MAC address
↓
Traffic redirection
↓
MITM / interception / modification
Source: Wenliang Du, ARP Cache Poisoning Attack Lab.
30. What the Five Textbooks Contribute
| Book | ARP contribution |
|---|---|
| Kurose & Ross, 8th ed. | Detailed ARP functionality, ARP table, request/reply process, TTL/soft state, relationship between IP and MAC addressing |
| Wenliang Du, 2nd ed. | ARP security weakness, ARP cache poisoning, forged IP-to-MAC mappings, MITM consequences |
| Gordon Lyon / Nmap | ARP scanning on Ethernet LANs and practical packet-level ARP behavior |
| Gregor N. Purdy / iptables | No substantive ARP protocol architecture or ARP-poisoning treatment used here |
| James Forshaw | No ARP-specific treatment used here |
This distinction is intentional: the notes do not import general ARP material from outside the five specified references.
31. Most Important Diagram to Memorize
HOST A
|
| wants to send to IP B
v
+--------------+
| ARP Cache |
+--------------+
|
Is IP B mapped?
/ \
yes no
| |
| v
| ARP Request
| (broadcast)
| |
| v
| HOST B
| |
| ARP Reply
| |
+----<----+
|
v
MAC address B
|
v
Ethernet frame
|
v
LAN
32. ARP Poisoning Diagram to Memorize
ATTACKER
|
| forged ARP mapping
v
+---------+
| Victim A|
| ARP |
| Cache |
+---------+
|
IP(B) → MAC(M)
|
v
Ethernet frame
|
v
ATTACKER
|
| forward / modify
v
Victim B
For a two-way MITM position:
IP(B) → MAC(Attacker)
Victim A ------------------------------> Attacker
|
|
v
Victim B
IP(A) → MAC(Attacker)
Victim B ------------------------------> Attacker
Source: Wenliang Du, ARP Cache Poisoning Attack Lab.
33. Revision Notes
ARP
===
Address Resolution Protocol
Purpose:
IP address → MAC address
Scope:
Local LAN / link
ARP Cache:
Stores IP ↔ MAC mappings
Entry:
<IP address, MAC address, TTL>
ARP Request:
Broadcast
Destination MAC = FF:FF:FF:FF:FF:FF
ARP Reply:
Normally unicast to requester
Normal flow:
Need MAC
↓
Check ARP cache
↓
Missing?
↓
Broadcast ARP request
↓
Target replies
↓
Cache mapping
↓
Build Ethernet frame
SECURITY
========
Basic ARP has no authentication/security mechanism.
ARP Cache Poisoning:
Attacker supplies forged IP-to-MAC mapping
↓
Victim accepts poisoned mapping
↓
Ethernet frames go to attacker's MAC
↓
Traffic can be intercepted
↓
Can enable MITM
- MITM
- Session Hijacking
- Deniel of Service
KEY DISTINCTION
===============
IP spoofing:
Fake IP address in IP packet
ARP poisoning:
Fake IP → MAC mapping in ARP cache
34. Exact Sources From the Specified Books
Kurose & Ross
James F. Kurose and Keith W. Ross, Computer Networking: A Top-Down Approach, 8th ed., Pearson, 2020.
Primary source
Chapter 6 — The Link Layer and LANs
§6.4 — Switched Local Area Networks
§6.4.1 — Link-Layer Addressing and ARP
In the verified 8th-edition table of contents and text, §6.4.1 begins on p. 478.
Topics used here:
- Need for IP-to-MAC resolution
- ARP table
<IP address, MAC address, TTL>mapping- ARP request broadcast
- ARP reply
- Cache/soft state
- Plug-and-play behavior
Pearson's official 8th-edition contents confirm §6.4.1 Link-Layer Addressing and ARP and §6.4.2 Ethernet. citeturn569208search2turn569208search4
The authors' Ethernet and ARP Wireshark Lab v8.0 also explicitly says students should review §6.4.1 and §6.4.2 before analyzing ARP traffic. citeturn569208search40
Gordon Lyon — Nmap
Gordon Lyon, Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning, Nmap Project, 2009.
Primary source
Chapter 3 — Host Discovery Techniques
ARP Scan (-PR)
Topics used here:
- ARP on Ethernet LANs
- Need to determine destination hardware/MAC address before sending an Ethernet frame
- ARP request broadcast
- ARP-based local host discovery
- Practical ARP packet behavior
- Source MAC control/spoofing in raw Ethernet scanning
The official Nmap chapter states that on Ethernet LANs, ARP is the default scan type for local targets and explains that the operating system needs the destination hardware address to construct the Ethernet frame. citeturn560959search3
Wenliang Du
Wenliang Du, Computer & Internet Security: A Hands-on Approach, 2nd ed.
Primary attack source
The associated author-provided SEED Labs — ARP Cache Poisoning Attack Lab is the detailed hands-on source for the ARP attack material.
Relevant sections:
- 1 Overview
- 2 Task 1: ARP Cache Poisoning
- Environment/setup discussion
Topics used here:
- ARP discovers a link-layer/MAC address from an IP address
- ARP does not implement security measures
- Forged IP-to-MAC mappings
- Traffic redirection
- Man-in-the-Middle attacks
- Packet interception and modification
- ARP poisoning being limited to hosts on the same LAN
The author explicitly states that ARP cache poisoning can fool a victim into accepting forged IP-to-MAC mappings and redirect packets to the attacker's machine. citeturn784556search28turn784556search31
The SEED workshop material also identifies ARP Cache Poisoning Labs as part of the material associated with Du's book and places it alongside the packet sniffing/spoofing material. citeturn596989search4
Gregor N. Purdy — iptables
Gregor N. Purdy, Linux iptables Pocket Reference, O'Reilly Media, 2004.
This book's contents cover:
- IPv4 matches
- MAC matching
- Netfilter
- Connection tracking
- Packet filtering
- NAT
but I have not used Purdy as a source for ARP functionality or ARP cache poisoning, because the accessible book material does not provide a substantive ARP protocol/attack treatment.
This respects the requirement that the notes use only material actually attributable to the specified books. The book's command-reference contents confirm its focus on IPv4 matches, MAC matches, connection tracking, NAT, and related iptables functions. citeturn560959search13
James Forshaw
James Forshaw, Attacking Network Protocols: A Hacker's Guide to Capture, Analysis, and Exploitation, No Starch Press, 2017.
Forshaw's book provides general material on:
- Network architecture and protocols
- Internet Protocol Suite
- Data encapsulation
- Network routing
- Network traffic capture
- Network spoofing and redirection
but I have not used Forshaw as a source for ARP-specific functionality or ARP cache poisoning, because I could not verify a substantive ARP-specific treatment in the accessible textbook contents.
The publisher/O'Reilly contents confirm the book's networking foundation and its later coverage of network spoofing/redirection, but do not establish an ARP-specific section. citeturn560959search0turn560959search9
35. Final Mental Model
The entire topic can be reduced to two ideas:
Functionality
IP address
↓
ARP cache lookup
↓
MAC address
↓
Ethernet frame
↓
LAN
Attack
Forged ARP information
↓
Poisoned IP → MAC mapping
↓
Wrong Ethernet destination
↓
Traffic redirected
↓
MITM / interception / modification
The key sentence to remember is:
ARP translates a known IP address into the local link-layer address needed for Ethernet delivery; ARP cache poisoning abuses the lack of authentication in this mapping process to redirect traffic.
References
- Kurose & Ross — Computer Networking: A Top-Down Approach, 8th ed., Chapter 6, §6.4.1 — Link-Layer Addressing and ARP. citeturn569208search2turn569208search40
- Gordon Lyon — Nmap Network Scanning, Chapter 3 — Host Discovery Techniques, ARP Scan (
-PR). citeturn560959search3 - Wenliang Du — Computer & Internet Security: A Hands-on Approach, 2nd ed.; associated SEED Labs ARP Cache Poisoning Attack Lab, Overview and Task 1. citeturn784556search28turn784556search31
- Gregor N. Purdy — Linux iptables Pocket Reference, O'Reilly Media, 2004. Used only to establish that the book's relevant reference material is focused on Netfilter/iptables rather than ARP. citeturn560959search13
- James Forshaw — Attacking Network Protocols, No Starch Press, 2017. No ARP-specific material from this book is used in these notes. citeturn560959search0turn560959search9