What Is ARP? Address Resolution Protocol Explained for Beginners

 What is ARP? ARP stands for Address Resolution Protocol. It helps a device find the MAC address of another device on the same local network when it only knows the IP address. Without ARP, devices on a LAN would not know where to send their data.

In this guide, you will learn how ARP works step by step, how to check the ARP table on Windows and Cisco devices, and why ARP matters for troubleshooting and security.

ARP in One Minute

• Problem: You know the IP address of a device, but the network needs its MAC address to deliver data.
• Solution: ARP asks the network, "Who has this IP address?" and the owner replies with its MAC address.
• Where it works: Only inside the same local network (LAN), between Layer 2 and Layer 3.

Not sure about the layers? Read our guide on the OSI Model vs. TCP/IP Model.

Why Do We Need ARP?

A device uses two kinds of addresses:

Address	Example	Used for
IP address	192.168.1.20	Finding a device on the network
MAC address	00-1A-2B-3C-4D-5E	Delivering data inside the LAN

When your computer sends data to another device on the same LAN, the data is placed in an Ethernet frame. That frame needs the destination MAC address. But applications usually only know the IP address. ARP connects the two.

How ARP Works Step by Step

Imagine PC1 (192.168.1.10) wants to talk to PC2 (192.168.1.20) on the same network.

1. Check the cache: PC1 looks in its ARP table to see if it already knows PC2's MAC address.
2. ARP request: If not, PC1 sends a message to all devices on the LAN (a broadcast): "Who has 192.168.1.20?"
3. Everyone receives it: Every device gets the message, but only PC2 recognizes its own IP address.
4. ARP reply: PC2 answers PC1 directly (unicast) with its MAC address.
5. Save and send: PC1 saves the result in its ARP table and sends the data to PC2.

Next time, PC1 uses the saved entry and does not need to ask again.

ARP Request vs. ARP Reply

	Request	Reply
Sent to	Everyone (broadcast)	One device (unicast)
Message	"Who has this IP?"	"I have it. My MAC is..."
Sent by	The device that needs the MAC	The device that owns the IP

What About Devices on Another Network?

ARP only works inside one LAN. If the destination is on a different network, such as a website on the internet, your computer does not ask for that device's MAC address.

Instead, it uses ARP to find the MAC address of your default gateway (usually your router). The router then forwards the data toward its destination.

What Is the ARP Table?

The ARP table (or ARP cache) is a small list stored on each device. It keeps the IP addresses and MAC addresses the device learned recently. This saves time, because the device does not have to send a new ARP request every time.

Entries are dynamic, which means they are removed after a short time if they are not used. This keeps the table up to date when devices change.

How to Check the ARP Table on Windows

Open Command Prompt and run:

arp -a

The output shows the IP address, the MAC address (called Physical Address), and the type, which is usually dynamic.

To clear the ARP table, open Command Prompt as administrator and run:

arp -d *

Clearing the table is a useful test when you suspect a wrong or old entry.

How to Check the ARP Table on Cisco Devices

On a Cisco router or Layer 3 switch, use:

show ip arp

The output lists each IP address, its MAC address, the age of the entry, and the interface. If you see the word Incomplete, the device sent an ARP request but did not get a reply.

ARP Security: What Is ARP Spoofing?

ARP trusts any reply it receives. An attacker on the same LAN can send fake ARP replies to make other devices believe the attacker's MAC address belongs to the router or another device. This is called ARP spoofing (or ARP poisoning). The attacker can then read or change the traffic.

To reduce the risk:

• Use Dynamic ARP Inspection (DAI) on supported Cisco switches.
• Use port security to limit which devices can connect to a port.
• Separate users with VLANs.
• Use encrypted protocols such as HTTPS and SSH.

Common ARP Problems

• Wrong or old entry: Clear the ARP table and try again.
• Duplicate IP address: Two devices with the same IP can cause random connection drops and confusing ARP entries.
• No reply: The device may be off, in a different VLAN, or blocked by a firewall or switch setting.

Frequently Asked Questions

What does ARP stand for?

ARP stands for Address Resolution Protocol.

What does ARP do?

It finds the MAC address that belongs to a known IPv4 address on the local network.

Does ARP work on the internet?

No. ARP works only inside one local network. For remote destinations, your device uses ARP to reach the default gateway.

Does IPv6 use ARP?

No. IPv6 uses Neighbor Discovery Protocol (NDP) instead of ARP.

Is ARP a Layer 2 or Layer 3 protocol?

It works between the two. Many books place it at Layer 2, and others place it at Layer 3. For the CCNA, remember that it connects IP addresses (Layer 3) to MAC addresses (Layer 2).

Which port does ARP use?

None. ARP does not use TCP or UDP, so it has no port number. It works directly on the data link layer. For more on ports, see our guide on Common Network Ports and Protocols.

Conclusion

ARP is a small protocol with a big job. It lets devices turn IP addresses into MAC addresses so data can be delivered inside a local network. Once you understand ARP, topics like switching, VLANs, and troubleshooting become much easier.

To see where TCP and UDP fit with these layers, read TCP vs UDP: Key Differences Explained for Beginners.

Next on BayteNet: Subnetting Step by Step.

Leave a comment if you have any questions!