In the world of computer networking, devices must resolve logical addresses to physical ones before they can communicate on a local segment. While we often think in terms of IP addresses (Layer 3), actual data transmission on Ethernet networks depends on MAC addresses (Layer 2). That’s where Address Resolution Protocol (ARP) in IPv4 and its more advanced IPv6 counterpart, Neighbor Discovery Protocol (NDP), come into play.
These two protocols silently handle address resolution under the hood, enabling seamless communication within local networks. Let’s explore how they work—and observe their behavior in action using tcpdump.
ARP in IPv4: Translating IP to MAC
ARP is the mechanism that IPv4 uses to map an IP address to a MAC address on the local network.
ARP Workflow:
- Check ARP Cache
The source device first consults its ARP cache to see if it already knows the MAC address for the target IP. - Send ARP Request
If not cached, it broadcasts an ARP Request asking: "Who has IP X.X.X.X? Tell me." - Process Request
All devices receive the request, but only the one with the matching IP responds. - Receive ARP Reply
The target device sends a unicast ARP Reply containing its MAC address. - Update ARP Cache
The source stores the IP-to-MAC mapping in its cache for future use.
ARP Example in tcpdump
To observe ARP in real time, use:
