Overview
Address Resolution Protocol (ARP) is the 'glue' between the Network Layer (IP) and the Data Link Layer (MAC). Since hardware only understands MAC addresses, ARP is needed to find the MAC address of a device when only its IP is known.
How it Works
- ARP Request: 'Who has IP 192.168.1.5? Tell 192.168.1.1.' (Broadcast)
- ARP Reply: 'I have 192.168.1.5, my MAC is AA:BB:CC...' (Unicast)
- ARP Cache: Devices store these mappings locally to avoid repeated requests.
Security
ARP Spoofing is a technique where an attacker sends fake ARP messages to link their MAC address with the IP of another host (like the gateway), enabling man-in-the-middle attacks.