ARP Protocol Operation

Overview

The Address Resolution Protocol (ARP) is a fundamental network protocol used to map network layer addresses, such as IPv4 addresses, to link layer addresses, typically MAC addresses, within a local area network. ARP is foundational for enabling communication between devices on Ethernet and other broadcast-capable networks by resolving address information necessary for packet delivery.

Core Components

• ARP Request and ARP Reply messages used for address resolution
• ARP cache, a local table storing recently resolved IP-to-MAC address mappings
• Broadcast domain as the operational scope for ARP requests
• Network interface controllers (NICs) that process ARP packets

How It Works

When a device needs to communicate with another device on the same local network but only knows its IP address, it broadcasts an ARP request to all hosts in the broadcast domain asking for the MAC address associated with that IP. The device owning the IP responds with an ARP reply containing its MAC address. The requesting device updates its ARP cache with this mapping and uses the MAC address to encapsulate packets for delivery. Trust relationships are implicit and local, relying on the assumption that ARP replies are accurate within the broadcast domain. Control boundaries are limited to the local network segment, as ARP does not operate across routers.

Trust & Security Model

• ARP lacks built-in authentication or authorization mechanisms, assuming trusted local network participants
• Trust boundaries are confined to the local broadcast domain, with no cryptographic verification of ARP messages
• Identity is established solely by IP and MAC address association without credentials or keys

Common Misconfigurations & Weaknesses

• Unrestricted ARP broadcasts leading to excessive network traffic
• Static ARP entries misconfigured or outdated, causing communication failures
• Absence of ARP filtering or validation enabling spoofing attacks
• Failure to segment networks, increasing exposure to ARP-based attacks

Attack Surface & Abuse Scenarios

• ARP spoofing or poisoning attacks where malicious actors send forged ARP replies to intercept or disrupt traffic
• Man-in-the-middle (MITM) attacks exploiting ARP’s lack of authentication
• Denial of service through ARP cache exhaustion or broadcast storms
• Cross-domain risks arise when attackers gain access to the local network segment

Visibility & Monitoring

• Network devices and security tools can log ARP traffic and cache changes
• Monitoring ARP anomalies is challenging due to the protocol’s broadcast nature and lack of authentication
• Operational observability requires correlation with other network telemetry to detect spoofing or unusual ARP activity

Hardening & Security Controls

• Implement static ARP entries for critical devices to prevent spoofing
• Use dynamic ARP inspection (DAI) and ARP filtering on managed switches
• Segment networks to limit ARP broadcast domains
• Deploy intrusion detection systems (IDS) capable of identifying ARP anomalies

Operational Considerations

• Maintain ARP cache lifecycle with appropriate timeouts and refresh mechanisms
• Ensure availability by preventing ARP-related broadcast storms and cache poisoning
• Scale ARP operations by segmenting large networks and using VLANs to reduce broadcast scope

Related Domains & Dependencies

• IPv4 networking protocols that rely on ARP for address resolution
• Switching infrastructure supporting broadcast and multicast traffic
• Security controls such as DHCP snooping and network access control (NAC) that complement ARP security

Standards & References

• RFC 826: An Ethernet Address Resolution Protocol
• RFC 1122: Requirements for Internet Hosts—Communication Layers
• Industry best practices for network segmentation and ARP security