Address Resolution

IP addresses identify where devices are in the network topology. MAC addresses identify the physical hardware on the local network. But here's the fundamental challenge: IP packets must ultimately be delivered in frames, and frames require MAC addresses.

When your laptop wants to send a packet to 192.168.1.1, it knows the destination IP—but the network interface card needs to know the destination MAC address to construct the Ethernet frame. How does the system bridge this gap?

This is the address resolution problem: translating between layer 3 (logical) addresses and layer 2 (physical) addresses. The protocols that solve this problem—ARP for IPv4 and Neighbor Discovery for IPv6—are among the most fundamental in networking, operating silently behind every packet delivery.

Consider what happens when Host A wants to send an IP packet to Host B on the same local network:

What Host A knows:

• Destination IP address: 192.168.1.100
• Host A's own MAC address: 00:11:22:33:44:55
• Host A's own IP address: 192.168.1.50

What Host A needs to know:

• Host B's MAC address: ??:??:??:??:??:??

Why IP alone isn't sufficient:

IP addresses have no physical meaning—they're assigned by software and can change. Ethernet switches don't understand IP; they forward frames based on MAC addresses. The network interface card transmits frames, not packets directly.

To deliver the packet, Host A must:

1. Construct an IP packet with destination 192.168.1.100
2. Encapsulate it in an Ethernet frame
3. Address the frame to Host B's MAC address
4. Transmit the frame

Step 3 is impossible without knowing Host B's MAC address.

When Resolution is Needed:

Address resolution occurs in two scenarios:

1. Direct Delivery (Same Network) When the destination IP is on the same network (determined by subnet mask), the sender resolves the destination IP directly to a MAC address.

2. Indirect Delivery (Different Network) When the destination IP is on a different network, the sender must send the packet to its default gateway (router). It resolves the router's IP to a MAC address—not the final destination's.

In both cases, the process is the same: IP address → MAC address mapping via resolution protocol.

The Address Resolution Protocol (ARP), defined in RFC 826, resolves IPv4 addresses to MAC addresses through a simple request-reply mechanism.

ARP Request (Broadcast):

When a host needs to resolve an IP address:

1. Host constructs an ARP Request message containing:
   • "Who has IP address X?"
   • Sender's IP and MAC addresses
2. Host broadcasts the request to all devices (destination MAC: FF:FF:FF:FF:FF:FF)
3. Every device on the local network receives the broadcast

ARP Reply (Unicast):

The device with the requested IP address responds:

1. Device recognizes its own IP in the request
2. Device constructs an ARP Reply containing:
   • "I have IP X. My MAC is Y."
   • Sent unicast to the requester
3. Original host receives the reply and now knows the mapping

Broadcasting ARP requests for every packet would be incredibly inefficient—broadcasts consume bandwidth on every device, and the latency would be intolerable. The solution is the ARP cache: a local table storing recent IP-to-MAC mappings.

ARP Cache Behavior:

1. Before sending: Check if destination IP is in ARP cache
2. Cache hit: Use cached MAC immediately—no ARP needed
3. Cache miss: Send ARP request, wait for reply, cache result
4. Timeout: Entries expire after a period (typically 2-20 minutes)
5. Refresh: Communication may refresh entry timers

Cache Timeout Tradeoffs:

• Short timeout (1-2 minutes): Quickly adapts to network changes (device moved, IP reassigned) but more ARP traffic
• Long timeout (20-60 minutes): Less ARP traffic but stale entries may cause problems if devices change
• Static entries: Never expire; used for critical infrastructure but require manual management

Most operating systems use 2-20 minute dynamic timeouts, with revalidation through normal traffic patterns.

Gratuitous ARP:

A device may broadcast its own IP-MAC mapping unsolicited—this is Gratuitous ARP:

• Announces presence after boot or address change
• Allows other devices to update their caches proactively
• Detects IP address conflicts (if someone responds, collision exists)
• Used by high-availability systems to take over virtual IPs

ARP was designed in an era of trusted networks and has no built-in security. This makes it vulnerable to several attacks that exploit its trusting nature.

ARP Spoofing / Poisoning:

An attacker sends forged ARP replies, associating their MAC address with another device's IP (typically the gateway):

1. Attacker sends: "192.168.1.1 (gateway) is at [attacker's MAC]"
2. Victim caches this false mapping
3. Victim sends all gateway-bound traffic to attacker
4. Attacker can inspect, modify, or drop packets

This enables Man-in-the-Middle (MITM) attacks, where the attacker intercepts and forwards traffic between victim and gateway—reading passwords, modifying responses, or injecting malicious content.

Defense Mechanisms:

1. Dynamic ARP Inspection (DAI)

• Switch examines ARP packets
• Validates against DHCP snooping binding table
• Drops ARP with mismatched IP-MAC
• Requires managed switches

2. Static ARP Entries

• Manually configure known IP-MAC mappings
• Immune to spoofing but doesn't scale
• Appropriate for critical infrastructure

3. Private VLANs

• Isolate hosts from each other at Layer 2
• Hosts can only communicate via router (where DAI/DHCP snooping applies)
• Prevents direct ARP between potentially hostile hosts

4. Port Security

• Limit MAC addresses per switch port
• Prevents attacker from impersonating multiple devices
• Detects MAC flooding attacks

5. 802.1X Authentication

• Authenticate devices before network access
• Untrusted devices isolated or blocked
• Integrates with RADIUS/AAA infrastructure

Several variations and special cases of ARP behavior exist to handle unusual network configurations.

Proxy ARP:

A router can answer ARP requests on behalf of devices on other networks—this is Proxy ARP (RFC 1027).

Scenario: Host A (192.168.1.50/24) wants to reach Host B (192.168.2.100/24). Without proper routing configuration, Host A might try to ARP directly for 192.168.2.100, not realizing it's on a different network.

Proxy ARP Solution:

1. Router has interfaces on both networks
2. Router sees ARP request for 192.168.2.100 on the 192.168.1.x interface
3. Router responds with its own MAC address
4. Host A sends packets to router's MAC
5. Router forwards to Host B on the other network

Proxy ARP makes routing transparent to hosts with misconfigured subnet masks, but is generally considered a legacy workaround rather than a best practice.

ARP for Non-Ethernet Networks:

ARP is hardware-agnostic—its format includes hardware type fields that specify the link layer technology. While Ethernet is most common, ARP works on:

• IEEE 802.11 (WiFi): Frames ultimately deliver to MAC addresses
• Token Ring: Historical, same ARP concepts applied
• FDDI: Fiber networks using MAC-style addressing

Virtual Environment Considerations:

Virtual machines, containers, and cloud instances present unique ARP scenarios:

• VM Migration: When a VM moves between hypervisors, its MAC may change or appear on a different physical port. Gratuitous ARP updates switches and peer caches.
• Container Networking: Containers may share host's MAC with virtual IPs, using Host NAT or overlay networks to manage addressing.
• Cloud Virtual Networks: Cloud providers implement ARP at the hypervisor/SDN layer, often with optimized or controlled behavior to prevent abuse.

IPv6 replaces ARP with the Neighbor Discovery Protocol (NDP), defined in RFC 4861. NDP uses ICMPv6 messages rather than a separate protocol and provides significantly enhanced functionality.

NDP Message Types:

Address Resolution with NS/NA:

NDP address resolution is similar to ARP but uses multicast instead of broadcast:

1. Host needs MAC for 2001:db8::100
2. Host sends Neighbor Solicitation to solicited-node multicast address:
   • Multicast: ff02::1:ff00:0100 (derived from target's last 24 bits)
   • Only devices with addresses ending in ...00:0100 listen
3. Target responds with Neighbor Advertisement (unicast)
4. Host caches the mapping

NDP Improvements Over ARP:

1. Multicast, not Broadcast: Solicited-node multicast targets only potentially matching hosts, reducing network load
2. Integrated Protocol: Part of ICMPv6, not a separate protocol
3. Router Discovery: Hosts find routers automatically without configuration
4. Prefix Information: Routers advertise network prefixes for SLAAC
5. Neighbor Unreachability Detection (NUD): Actively verifies neighbor reachability
6. Redirect Messages: Routers redirect hosts to better next hops
7. SEND (Secure NDP): Optional cryptographic security extension

Let's trace address resolution through a complete packet delivery scenario to see how all the pieces fit together.

Scenario: Host A (192.168.1.50) connects to web server (10.0.0.100) on another network.

Network Configuration:

• Host A: 192.168.1.50/24, Gateway: 192.168.1.1
• Router: 192.168.1.1 ↔ 10.0.0.1
• Server: 10.0.0.100/24

Critical Observations:

1. IP addresses never change across the journey (192.168.1.50 → 10.0.0.100)
2. MAC addresses change at every hop (Host A → Router, Router → Server)
3. Resolution happens at each hop for the next-hop destination only
4. ARP is transparent to higher layers—applications never see it
5. Caching is essential for performance—without it, every packet would require resolution

This pattern repeats for every hop in a multi-router path. The IP layer provides end-to-end addressing; the data link layer and ARP provide point-to-point delivery between each pair of adjacent devices.