The ARP Protocol and Why It Is Sensitive — Networks, Linux and Systems: The Technical Foundations of Cybersecurity

Every time your computer talks to another machine on the same network, it needs a physical address, not just an IP address. A tiny protocol called ARP finds it, silently, thousands of times a day. ARP was designed in a more trusting era, and it has no built-in way to verify who is answering. Understanding that weakness, and the defences against it, is a classic rite of passage in network security.

In the last lesson you learned to capture packets. Here you will use that skill to watch ARP at work on your own network.

The problem ARP solves

Recall the two kinds of addresses. An IP address is a logical address that depends on the network you are on. A MAC address belongs to the network card. On an Ethernet or Wi-Fi network, frames are delivered between neighbours by MAC address. So when your computer wants to send a packet to 192.168.1.20, which is on the same network, it needs to know the MAC address that goes with that IP address. The Address Resolution Protocol (ARP) provides that mapping for IPv4.

If the destination is on another network, your computer does not ask for the destination's MAC but for the MAC of the default gateway, since that is the next hop.

How ARP works

The exchange is simple and happens in two steps:

ARP request (broadcast): "Who has 192.168.1.20? Tell 192.168.1.42." It is sent to the broadcast MAC address, so every machine on the segment receives it.
ARP reply (unicast): the machine that owns 192.168.1.20 answers directly: "192.168.1.20 is at 3c:22:fb:12:34:56."

The requester stores the result in its ARP cache (also called the neighbour table) so it does not need to ask again for a while. You can display it on your own machine:

arp -a
ip neigh show

The first command works on Windows, macOS and many Linux systems; the second is the modern Linux equivalent. You will see pairs of IP and MAC addresses for the machines your computer talked to recently, typically starting with your gateway.

A machine can also send a gratuitous ARP: an unprompted announcement of its own address, used legitimately when a device boots up or when a backup server takes over the address of a failed one.

The design weakness

Look at what is missing: ARP has no authentication. Three properties make it sensitive:

Any machine on the network can send a reply, even if nobody asked.
Most systems accept and cache those unsolicited replies, so the latest answer tends to win.
The cache is the thing that decides where your packets go, so whoever controls it controls the path.

This allows a class of attacks generally called ARP spoofing or ARP poisoning. The idea, described at the conceptual level only, is that a malicious machine on the same local network sends false ARP messages claiming that the IP address of the gateway belongs to its own MAC address. Victims then send traffic meant for the router to the malicious machine, which can read it, alter it or simply drop it. Because the attacker sits "in the middle", this is called a man-in-the-middle position. It works only inside the local network segment, which is why an attacker first needs a foothold there: a compromised laptop, a rogue device plugged into a wall port, or someone on the same open Wi-Fi.

The consequences explain why we insisted on HTTPS in chapter 1. If the traffic is encrypted end to end, a man in the middle sees only unreadable data, though they can still disrupt the connection. If it is in clear text, the confidentiality is lost.

Observe, do not attack

This course does not teach you how to carry out an ARP spoofing attack, and you should not try one outside a lab that you own. Interfering with the traffic of other people on a network, even a home network that is not yours, is an offence in most countries: in France, articles 323-1 to 323-3-1 of the Code pénal cover fraudulent access to and tampering with data-processing systems. Later courses of this track show how professionals test these weaknesses legally, in a lab, with written authorisation when working for a client.

Spotting the signs in a capture

Because you now know how ARP works, you also know what an anomaly looks like. In Wireshark, the display filter arp shows only ARP traffic. A healthy network has a few requests and replies. Warning signs for an administrator include:

Two different MAC addresses claiming the same IP address (Wireshark flags this with a "duplicate IP address detected" warning in its analysis).
The MAC address of the gateway suddenly changing in the ARP caches of several machines.
A flood of gratuitous or unsolicited ARP replies from a single machine.

The display filter arp.duplicate-address-detected and the menu Analyze > Expert Information can help to find the first sign. Tools such as arpwatch record changes in IP-to-MAC pairs over time and alert an administrator.

How defenders protect against it

There is no single switch that fixes ARP, but a combination of measures reduces the risk:

Dynamic ARP Inspection and DHCP snooping on managed switches: the switch builds a trusted table of IP-to-MAC bindings from the DHCP conversations and drops ARP messages that contradict it.
Port security: limit the number or the identity of MAC addresses allowed on each switch port.
Network segmentation (next lessons): the smaller the segment, the fewer potential attackers share it.
Static ARP entries for critical devices such as the gateway or a server. This works but does not scale.
Encryption everywhere: HTTPS, SSH, VPN. Even if an attacker intercepts, the content stays unreadable.
Physical control: disable unused wall ports, and use 802.1X authentication to make devices prove who they are before connecting.
Monitoring with tools that detect changes in MAC bindings.

IPv6 does not use ARP. It has an equivalent mechanism, the Neighbor Discovery Protocol, with its own security considerations, which we discuss in the last lesson of this chapter.

Your turn: observe ARP on your own network

On your computer, display your ARP cache with arp -a (or ip neigh show) and write down the MAC address of your gateway. Start a Wireshark capture with the display filter arp. In a terminal, ping the gateway, and, if you have another device at home, ping it too. Stop the capture. Answer: did you see a request and a reply? Who sent the request to the broadcast address? What is the MAC address in the reply, and does it match your cache? Finally, explain in two sentences why a second device claiming your gateway's IP address would be a problem.

See a solution

If the ARP cache already contained the gateway, you may need to wait a minute or delete the entry for the capture to show a fresh request (on many systems, a cache entry expires within minutes). You should see a request such as "Who has 192.168.1.1? Tell 192.168.1.42" sent to ff:ff:ff:ff:ff:ff, the broadcast MAC address, followed by a unicast reply "192.168.1.1 is at ..." from the gateway. The MAC in the reply matches the one in the cache, because the cache is filled by that very reply. A second device claiming the gateway's IP could capture or disturb the traffic of every machine that believes it, because machines send their outgoing traffic to the MAC address associated with the gateway IP; ARP has no way to check which claim is legitimate.

Key takeaways

ARP maps IPv4 addresses to MAC addresses on a local network, using a broadcast request and a unicast reply.
It has no authentication, and most systems accept unsolicited replies: that is the root of ARP spoofing.
The attack only works inside the same segment, and is neutralised by encryption for confidentiality, but not for availability.
Defences: dynamic ARP inspection, DHCP snooping, port security, segmentation, 802.1X, monitoring.
Next lesson: segmentation with VLANs, one of the best tools for reducing who shares a segment.