Table of Contents

ARP Explained: How Address Resolution Protocol Works, ARP Tables, Gratuitous ARP and Troubleshooting

When a computer wants to communicate with another IPv4 device on the same Ethernet network, knowing the destination IP address is not enough. Ethernet switches forward frames using MAC addresses, while applications and IP routing operate using IP addresses.

Something must connect these two addressing systems.

That mechanism is the Address Resolution Protocol (ARP).

ARP allows an IPv4 host to discover the link-layer address associated with an IPv4 address on its local network. In a typical Ethernet environment, this means learning the destination device’s MAC address—or the MAC address of the default gateway when the destination is on another IP network.

A simplified example looks like this:

PC-A
IP: 192.168.10.10
MAC: AA:AA:AA:AA:AA:AA
        |
        | "Who has 192.168.10.20?"
        v
      Switch
        |
        v
PC-B
IP: 192.168.10.20
MAC: BB:BB:BB:BB:BB:BB

PC-B responds:

192.168.10.20 is at BB:BB:BB:BB:BB:BB

PC-A can then build an Ethernet frame addressed to PC-B’s MAC address.

ARP appears simple, but it sits at one of the most important boundaries in TCP/IP networking. Understanding it helps explain default gateways, VLAN behavior, Layer 2 switching, local subnet communication, duplicate IP addresses, stale neighbor information, ARP spoofing, failover mechanisms, and many common connectivity failures.

This guide explains ARP from the packet level through practical troubleshooting.

For the surrounding networking concepts, read Computer Networking Explained, TCP/IP Explained, and Routers, Switches and Network Devices.

What Is ARP?

ARP stands for:

Address Resolution Protocol

ARP is defined in RFC 826 and is used to resolve protocol-layer addresses into link-layer addresses on networks such as Ethernet.

In the most common IPv4 Ethernet scenario, ARP answers a question like:

What MAC address corresponds to IPv4 address 192.168.1.50?

The result might be:

192.168.1.50
        |
        v
00:1A:2B:3C:4D:5E

The host can then send an Ethernet frame to that MAC address.

This relationship between IP and Ethernet addressing is fundamental to IPv4 communication on a local Ethernet network.

Why Is ARP Necessary?

Consider two computers:

PC-A
IP: 192.168.1.10
MAC: AA:AA:AA:AA:AA:AA

and:

PC-B
IP: 192.168.1.20
MAC: BB:BB:BB:BB:BB:BB

PC-A wants to send an IPv4 packet to:

192.168.1.20

At Layer 3, PC-A knows the destination IP address.

But the IP packet must normally be encapsulated inside an Ethernet frame for transmission across the local Ethernet network.

That frame needs a destination MAC address:

Ethernet Frame
+-------------------------+
| Destination MAC         |
+-------------------------+
| Source MAC              |
+-------------------------+
| EtherType               |
+-------------------------+
| IPv4 Packet             |
+-------------------------+

PC-A therefore needs to determine:

192.168.1.20 → Which MAC address?

ARP performs that resolution.

IP Address vs MAC Address

Understanding ARP requires understanding the different jobs of IP and MAC addresses.

Address	Primary Role
IP address	Logical Layer 3 addressing and routing
MAC address	Link-layer identification and local Ethernet forwarding

A simplified packet path is:

Application
    |
    v
TCP / UDP
    |
    v
IP packet
    |
    v
Ethernet frame

The IP packet may contain:

Source IP:      192.168.1.10
Destination IP: 192.168.1.20

while the Ethernet frame contains:

Source MAC:      AA:AA:AA:AA:AA:AA
Destination MAC: BB:BB:BB:BB:BB:BB

ARP helps the sender determine the appropriate destination MAC for local delivery.

For a deeper explanation of these layers, see TCP/IP Explained.

How ARP Works Step by Step

Suppose PC-A wants to communicate with PC-B.

Configuration:

PC-A
IP:   192.168.1.10
MAC:  AA:AA:AA:AA:AA:AA

PC-B
IP:   192.168.1.20
MAC:  BB:BB:BB:BB:BB:BB

Subnet:
192.168.1.0/24

PC-A determines that 192.168.1.20 belongs to its directly connected subnet.

It now needs PC-B’s link-layer address.

Step 1: Check the Neighbor/ARP Cache

PC-A first checks whether it already has a usable mapping:

192.168.1.20 → BB:BB:BB:BB:BB:BB

If a valid entry already exists, a new ARP request may not be necessary.

If no usable entry exists, ARP resolution begins.

Step 2: Send an ARP Request

PC-A broadcasts an ARP request:

Who has 192.168.1.20?
Tell 192.168.1.10

The Ethernet destination is the broadcast MAC:

FF:FF:FF:FF:FF:FF

Step 3: Switch Floods the Broadcast

The Ethernet switch floods the broadcast through appropriate forwarding ports in the same VLAN, except the port on which the frame arrived.

Step 4: PC-B Recognizes Its IP

Hosts receiving the ARP request inspect the target protocol address.

PC-B recognizes:

Target IP = 192.168.1.20

as its own address.

Step 5: PC-B Sends an ARP Reply

PC-B responds with information equivalent to:

192.168.1.20 is at BB:BB:BB:BB:BB:BB

The reply is normally unicast back toward PC-A.

Step 6: PC-A Learns the Mapping

PC-A can store the mapping in its neighbor/ARP cache:

192.168.1.20 → BB:BB:BB:BB:BB:BB

It can now construct Ethernet frames addressed to PC-B.

ARP Request Explained

An ARP request asks:

Which device owns this IPv4 address, and what is its hardware address?

A simplified request contains information such as:

Sender MAC
Sender IP
Target MAC
Target IP

For an unresolved target, the target hardware-address field is not yet known.

Example:

Sender IP:
192.168.1.10

Sender MAC:
AA:AA:AA:AA:AA:AA

Target IP:
192.168.1.20

Target MAC:
Unknown

The request is carried in an Ethernet broadcast so devices in the relevant local broadcast domain can receive it.

Why Is an ARP Request Broadcast?

The sender does not yet know the destination MAC.

It therefore cannot address the Ethernet frame directly to the target device.

Instead, it uses:

FF:FF:FF:FF:FF:FF

which represents the Ethernet broadcast destination.

Conceptually:

                Switch
             /     |      \
            /      |       \
           v       v        v
         PC-B     PC-C     PC-D

ARP Request:
"Who has 192.168.1.20?"

Every appropriate device in the VLAN can receive the broadcast.

Only the device responsible for the requested address should provide the normal ARP reply.

ARP Reply Explained

The ARP reply provides the requested address mapping.

Example:

ARP Request:
Who has 192.168.1.20?

Reply:

192.168.1.20 is at BB:BB:BB:BB:BB:BB

Unlike the initial request, the normal reply can be sent directly to the requesting host because the target already knows the requester’s MAC from the ARP request.

The exchange is therefore approximately:

PC-A                                      PC-B

ARP Request
Broadcast
---------------------------------------->

Who has 192.168.1.20?


ARP Reply
Unicast
<----------------------------------------

192.168.1.20 is at
BB:BB:BB:BB:BB:BB

After that, ordinary IP communication can proceed.

What Is an ARP Table?

Hosts do not want to broadcast an ARP request before every packet.

They therefore maintain learned neighbor information.

This is commonly called an:

ARP table

or:

ARP cache

Example:

IPv4 Address	MAC Address	Type
192.168.1.1	00:11:22:33:44:55	Dynamic
192.168.1.20	BB:BB:BB:BB:BB	Dynamic
192.168.1.50	CC:CC:CC:CC:CC	Dynamic

Operating systems may use a more sophisticated neighbor state machine than the simple word “cache” suggests.

On Linux, for example, IPv4 ARP information is integrated into the kernel neighbor subsystem and entries can have states such as:

REACHABLE
STALE
DELAY
PROBE
FAILED

So an ARP/neighbor entry is not necessarily a permanent IP-to-MAC mapping.

Viewing the ARP Table on Windows

A traditional Windows command is:

arp -a

You may see output similar to:

Interface: 192.168.1.10

Internet Address      Physical Address
192.168.1.1           00-11-22-33-44-55
192.168.1.20          bb-bb-bb-bb-bb-bb

Windows also provides modern PowerShell networking commands such as:

Get-NetNeighbor

which can expose neighbor information in greater detail.

Viewing ARP Neighbors on Linux

A modern Linux command is:

ip neigh

Example:

192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE
192.168.1.20 dev eth0 lladdr bb:bb:bb:bb:bb:bb STALE

Older systems may also provide:

arp -n

but ip neigh is generally the more appropriate modern Linux tool.

Local Destination vs Remote Destination

One of the most important ARP concepts is that a host does not normally ARP for every final destination IP address.

The host first determines whether the destination is:

Local/on-link

or:

Remote/reached through a router

This decision comes from the host’s routing information and interface configuration.

Consider:

PC
IP:      192.168.1.10
Prefix:  /24
Gateway: 192.168.1.1

Destination:

192.168.1.20

is on the local 192.168.1.0/24 network.

The host can ARP for:

192.168.1.20

directly.

But what if the destination is:

8.8.8.8

That address is not part of the local /24.

The host therefore does something different.

ARP and the Default Gateway

For a remote destination, the host needs to send the packet to the appropriate next-hop router.

Suppose:

PC
IP:      192.168.1.10
Gateway: 192.168.1.1

and the destination is:

8.8.8.8

The PC does not normally ask:

Who has 8.8.8.8?

on its local Ethernet network.

Instead, its routing table tells it to use:

192.168.1.1

as the next hop.

The PC therefore resolves the gateway’s MAC address:

Who has 192.168.1.1?

Suppose the answer is:

192.168.1.1 is at
00:11:22:33:44:55

The resulting Ethernet frame can contain:

Destination MAC:
00:11:22:33:44:55

while the encapsulated IP packet still contains:

Destination IP:
8.8.8.8

This distinction is fundamental.

MAC Destination vs IP Destination

For traffic leaving the local subnet:

Ethernet Destination MAC
=
Next-hop router

while:

IP Destination
=
Final remote host

Conceptually:

PC
192.168.1.10
    |
    | Ethernet destination:
    | Router MAC
    |
    | IP destination:
    | 8.8.8.8
    v
Router
    |
    v
Internet
    |
    v
8.8.8.8

The Layer 2 header changes as the packet traverses different links.

The IP destination generally remains the remote destination unless some Layer 3 function such as NAT modifies relevant addressing.

This is one of the clearest examples of how Layer 2 and Layer 3 work together.

ARP Does Not Cross Routers Normally

ARP operates within the local Layer 2 context.

A router separates Layer 2 broadcast domains.

Suppose:

LAN A
192.168.10.0/24
       |
       v
     Router
       |
       v
LAN B
192.168.20.0/24

An ARP broadcast generated in LAN A is not ordinarily forwarded by the router into LAN B.

Instead:

Host A
ARP → Gateway MAC

The router then forwards the IP packet through the appropriate next-hop network.

On LAN B, the router may perform its own ARP resolution for the destination host.

End-to-End ARP Example

Consider:

PC-A
192.168.10.10
        |
        v
Router
192.168.10.1
192.168.20.1
        |
        v
Server-B
192.168.20.50

PC-A wants to send data to Server-B.

PC-A sees that 192.168.20.50 is remote.

It resolves:

192.168.10.1 → Router MAC

The first Ethernet frame looks conceptually like:

Source MAC:
PC-A

Destination MAC:
Router

Source IP:
192.168.10.10

Destination IP:
192.168.20.50

The router receives the frame, removes the Layer 2 encapsulation, performs a routing decision, and forwards the IP packet toward the server network.

On the server-side Ethernet segment, the router may need:

192.168.20.50 → Server-B MAC

The new Ethernet frame then has:

Source MAC:
Router's LAN-B interface

Destination MAC:
Server-B

while the IP packet still identifies:

192.168.10.10 → 192.168.20.50

This illustrates why MAC addresses are link-local forwarding information rather than end-to-end Internet identifiers.

ARP and Ethernet Switches

A frequent source of confusion is the difference between:

ARP table

and:

MAC address table

They are not the same thing.

A host or Layer 3 device uses ARP to associate:

IPv4 address → MAC address

An Ethernet switch learns associations such as:

MAC address → Switch port

Example:

Host ARP Table

192.168.1.20
→ BB:BB:BB:BB:BB:BB

Switch MAC Table

BB:BB:BB:BB:BB:BB
→ Gi1/0/8

Together, these mechanisms allow the frame to reach the correct endpoint.

ARP Table vs MAC Address Table

Feature	ARP/Neighbor Table	Switch MAC Table
Maps	IPv4 → MAC	MAC → Port
Used primarily by	Hosts/routers/L3 devices	Ethernet switches
Main purpose	Neighbor resolution	Frame forwarding
Layer relationship	IPv4-to-link layer	Layer 2
Example	192.168.1.20 → BB…	BB… → Gi1/0/8

This distinction is extremely useful during troubleshooting.

If ARP resolution succeeds but traffic still fails, inspect the switching path, VLAN, security policy, routing, and destination host rather than repeatedly clearing ARP.

ARP and VLANs

ARP broadcasts remain within their relevant Layer 2 broadcast domain.

In a VLAN-based network:

VLAN 10
PC-A
PC-B

VLAN 20
PC-C
PC-D

an ARP broadcast generated by PC-A in VLAN 10 should not simply be flooded into VLAN 20.

Conceptually:

              Switch

      VLAN 10        VLAN 20

PC-A ----+              +---- PC-C
         |              |
PC-B ----+              +---- PC-D

ARP from PC-A
   |
   +----> PC-B
   |
   X----> PC-C
   X----> PC-D

This is one reason VLANs define Layer 2 broadcast boundaries.

Communication between VLANs requires Layer 3 forwarding.

ARP and Inter-VLAN Routing

Suppose:

VLAN 10
192.168.10.0/24
Gateway: 192.168.10.1

and:

VLAN 20
192.168.20.0/24
Gateway: 192.168.20.1

PC-A:

192.168.10.10

wants to reach:

192.168.20.50

PC-A does not normally ARP for 192.168.20.50.

It ARPs for:

192.168.10.1

The Layer 3 gateway routes the packet toward VLAN 20.

This distinction helps diagnose cases where:

Same VLAN works
Different VLAN fails

If same-subnet ARP and communication work, but inter-VLAN traffic fails, the likely problem may be:

Gateway
Routing
ACL
Firewall
Return route

rather than ARP on the originating LAN.

What Is Gratuitous ARP?

A Gratuitous ARP, often abbreviated GARP, is an ARP message sent without the ordinary preceding request/response sequence for resolving an unknown neighbor.

A device can announce information about its own IPv4 address and link-layer address.

Conceptually:

"I am 192.168.1.50,
and this address is associated with my MAC."

Gratuitous ARP can be useful for several operational purposes, including:

Updating neighboring ARP information
Detecting some address conflicts
High-availability failover
Announcing a MAC change

Exact behavior depends on the operating system and protocol implementation.

Gratuitous ARP and High Availability

Consider two systems participating in a high-availability service:

Server A
Active

Server B
Standby

Clients use a virtual address:

192.168.1.100

Initially:

192.168.1.100
→ MAC of Server A

If Server A fails, Server B may take over the virtual address.

But other devices could still have cached information pointing toward the old MAC.

A gratuitous ARP announcement can help update neighboring devices:

Before failover:

192.168.1.100
→ AA:AA:AA:AA:AA:AA

After failover:

192.168.1.100
→ BB:BB:BB:BB:BB:BB

This is why gratuitous ARP can appear in high-availability architectures.

Gratuitous ARP and Switch MAC Learning

Gratuitous ARP can also help switching infrastructure relearn where a MAC address or service has moved.

This becomes relevant during events such as:

VM migration
Cluster failover
Firewall failover
Virtual IP migration

A failover may therefore involve both:

ARP/neighbor updates

and:

switch MAC-table updates

These are related but separate mechanisms.

What Is Proxy ARP?

Proxy ARP occurs when a router or another Layer 3 device answers an ARP request on behalf of another IP destination.

Conceptually:

Host
 |
 | "Who has 192.168.2.50?"
 v
Router
 |
 | "Use my MAC."
 v
Host sends frame to router

The router can then forward the packet toward the actual destination.

Proxy ARP has legitimate uses, especially in certain legacy or specialized designs, but it can also hide incorrect subnet assumptions and make troubleshooting less intuitive.

Modern network design generally benefits from explicit routing rather than unnecessary dependence on Proxy ARP.

Static vs Dynamic ARP Entries

Most ARP information is learned dynamically.

Example:

192.168.1.20
→ BB:BB:BB:BB:BB:BB
Dynamic

Dynamic information can age or transition through neighbor states.

A static entry is manually configured.

Example concept:

192.168.1.20
→ BB:BB:BB:BB:BB:BB
Permanent

Static mappings can be useful in specialized situations but create administrative overhead.

If the device or NIC changes and the static MAC mapping is not updated, connectivity can fail.

For most endpoint networks, dynamic neighbor discovery is expected.

ARP Cache Aging

Dynamic ARP entries do not normally remain forever.

Operating systems age, validate, probe, or refresh neighbor information according to their own implementations.

This matters because the following assumption is unsafe:

Every operating system keeps ARP entries for exactly X minutes.

There is no single universal ARP-cache lifetime applicable to every operating system and network stack.

When troubleshooting, inspect the actual neighbor state rather than relying on a memorized timeout.

Duplicate IP Addresses and ARP

Duplicate IPv4 addresses can create some of the most confusing ARP-related failures.

Suppose two devices are configured with:

192.168.1.50

but have different MAC addresses:

Device A
192.168.1.50
AA:AA:AA:AA:AA:AA

Device B
192.168.1.50
BB:BB:BB:BB:BB:BB

Neighboring systems may observe inconsistent mappings:

192.168.1.50
→ AA:AA:AA:AA:AA:AA

then later:

192.168.1.50
→ BB:BB:BB:BB:BB:BB

Symptoms may include:

intermittent connectivity,
sessions reaching the wrong host,
duplicate IP warnings,
ARP entries changing unexpectedly,
services becoming reachable and unreachable,
apparent packet loss.

When an IP-to-MAC mapping unexpectedly alternates between two legitimate devices, duplicate addressing should be investigated.

ARP Spoofing and ARP Poisoning

ARP was designed for trusted local-network environments and does not provide strong cryptographic authentication of ARP mappings.

This creates an opportunity for attacks commonly described as:

ARP spoofing or ARP poisoning.

An attacker on an appropriate local Layer 2 network may attempt to send misleading ARP information.

For example, a victim should have:

192.168.1.1
→ Router MAC

but malicious ARP information attempts to make the victim associate:

192.168.1.1
→ Attacker MAC

Depending on network conditions and controls, this can facilitate:

Traffic interception
Man-in-the-middle behavior
Traffic disruption

ARP spoofing is fundamentally a local Layer 2 concern rather than an attack that arbitrary remote Internet hosts can normally perform against your LAN’s ARP cache.

For broader protection concepts, see Network Security Basics.

Defending Against ARP Spoofing

Enterprise switches can provide mechanisms that help mitigate certain ARP attacks.

One important example is:

Dynamic ARP Inspection (DAI)

DAI can validate ARP traffic against trusted binding information, commonly associated with DHCP Snooping environments.

Conceptually:

DHCP Snooping Binding
IP + MAC + VLAN + Port
          |
          v
Dynamic ARP Inspection
          |
          v
Validate ARP

Other protections can include:

network segmentation,
DHCP Snooping,
switch-port security,
secure wireless access,
endpoint monitoring,
encrypted application protocols such as HTTPS and SSH.

ARP security should be treated as one part of a layered network-security architecture.

Common ARP Problem: Incomplete Neighbor Entry

A host may attempt to resolve:

192.168.1.50

but receive no reply.

The neighbor entry may remain unresolved or enter a failed state.

Possible causes include:

Target device offline
Wrong VLAN
Incorrect subnet configuration
Switching problem
Wireless isolation
Host firewall/security behavior
Duplicate addressing
Incorrect route
Physical connectivity problem

Do not assume that “ARP failed” means ARP itself is malfunctioning.

Often ARP is revealing a deeper Layer 2 problem.

Common ARP Problem: Wrong MAC Address

Suppose:

192.168.1.50

should map to:

AA:AA:AA:AA:AA:AA

but the ARP table shows:

BB:BB:BB:BB:BB:BB

Investigate:

Duplicate IP
Recent failover
Virtual IP movement
Proxy ARP
ARP spoofing
Stale neighbor information

Then inspect the switch MAC table to determine where the unexpected MAC is physically or logically located.

Common ARP Problem: Stale Entry After Failover

A server moves from one system to another:

Virtual IP
192.168.1.100

Old mapping:

192.168.1.100
→ MAC-A

New active system:

192.168.1.100
→ MAC-B

If neighboring devices retain stale information, traffic can continue toward the wrong MAC until the entry is updated.

Check whether the HA platform sends appropriate gratuitous ARP announcements during failover.

Common ARP Problem: Wrong Subnet Mask

A wrong subnet mask can cause a host to make the wrong on-link decision.

Suppose the correct configuration is:

IP:
192.168.10.50

Prefix:
/24

but the host is incorrectly configured with a much broader prefix.

It may incorrectly believe that some remote destinations are directly connected and try to resolve them locally with ARP instead of sending packets to the gateway.

Symptoms can include:

Repeated unanswered ARP requests
Some local hosts reachable
Remote networks unreachable
Gateway apparently unused for affected destinations

Always verify the IP prefix when ARP behavior appears illogical.

Common ARP Problem: Wrong VLAN

Consider:

PC-A
192.168.10.20
Expected VLAN: 10

but the switch port is actually assigned to VLAN 20.

PC-A sends:

Who has 192.168.10.1?

but the real gateway is in VLAN 10.

The ARP request never reaches the expected gateway because the host is in the wrong Layer 2 broadcast domain.

Symptoms:

IP configuration looks correct
Gateway unreachable
ARP for gateway unanswered

This is an excellent example of why ARP troubleshooting frequently becomes VLAN troubleshooting.

Common ARP Problem: Gateway ARP Fails

Suppose:

Same local subnet communication works

but:

Default gateway unreachable

Check:

Gateway IP
Gateway interface/SVI state
VLAN assignment
Trunk
ARP request/reply
Duplicate IP
Gateway MAC

If the client cannot resolve the default gateway’s link-layer address, it cannot normally send IPv4 traffic beyond its local network through that gateway.

ARP Troubleshooting Workflow

A systematic workflow is more effective than repeatedly clearing caches.

Step 1: Verify IP Configuration

On Windows:

ipconfig /all

On Linux:

ip addr
ip route

Confirm:

IP address
Prefix/subnet mask
Default gateway
Interface

If these are wrong, ARP behavior may be perfectly correct for an incorrect configuration.

Step 2: Determine Whether the Destination Is Local

Ask:

Is the destination on-link?

If yes:

ARP should resolve the destination itself.

If no:

ARP normally resolves the next-hop gateway.

This distinction can immediately reveal incorrect troubleshooting assumptions.

Step 3: Inspect the ARP/Neighbor Table

Windows:

arp -a

or:

Get-NetNeighbor

Linux:

ip neigh

Look for:

Expected IP
Expected MAC
Neighbor state
Unexpected changes
Incomplete/failed entries

Step 4: Generate Traffic

Try reaching the target:

ping 192.168.1.20

But interpret ping carefully.

A failed ping does not automatically prove ARP failure because ICMP may be filtered.

The useful question is:

Did attempting communication trigger ARP resolution, and did the target respond?

Check the neighbor table again or capture packets.

Clearing ARP Information on Windows

The exact supported method can depend on Windows version and privileges.

Traditional commands include:

arp -d *

and administrative network commands can also be used to remove neighbor information.

However:

Clearing ARP should be a diagnostic action, not a universal solution.

If the underlying problem is a duplicate IP, wrong VLAN, bad gateway, or malicious ARP traffic, the incorrect state can return.

Flushing a Neighbor Entry on Linux

Linux provides flexible neighbor management with the ip command.

To remove a particular entry, an administrator can use a command such as:

sudo ip neigh del 192.168.1.20 dev eth0

To inspect entries:

ip neigh show

Exact interface names vary:

eth0
ens18
enp0s3
wlan0

After deletion, the kernel can resolve the neighbor again when communication requires it.

Packet-Level ARP Troubleshooting

Packet capture is one of the best ways to diagnose ARP.

A capture might show:

ARP Request:
Who has 192.168.1.20?
Tell 192.168.1.10

followed by:

ARP Reply:
192.168.1.20 is at BB:BB:BB:BB:BB:BB

If you see repeated requests:

Who has 192.168.1.20?
Who has 192.168.1.20?
Who has 192.168.1.20?

with no reply, investigate why the target cannot respond.

Possible causes include:

Target offline
Wrong VLAN
Layer 2 path failure
Incorrect IP
Port isolation
Security controls

ARP in Wireshark

Wireshark can filter ARP traffic with:

arp

Useful fields include:

Sender MAC address
Sender IP address
Target MAC address
Target IP address
Opcode

Typical opcodes distinguish requests from replies.

A capture allows you to answer:

Was the ARP request sent?

Did the expected device receive/respond?

Which MAC claimed the address?

Are multiple MACs claiming one IP?

This is often more reliable than guessing from application symptoms.

Troubleshooting ARP with tcpdump

On Linux, you can inspect ARP packets using:

sudo tcpdump -ni eth0 arp

Example output conceptually shows requests and replies as they cross the interface.

To focus on a specific host:

sudo tcpdump -ni eth0 arp and host 192.168.1.20

Packet capture is especially useful when an ARP entry repeatedly fails or changes.

ARP Troubleshooting Decision Tree

IPv4 connectivity problem
          |
          v
Correct IP/prefix?
      /       \
    NO         YES
    |           |
    v           v
Fix config   Destination local?
               /        \
             YES          NO
             |             |
             v             v
       Resolve target   Resolve gateway
          with ARP         with ARP
             |             |
             +------v------+
                    |
              ARP reply?
               /      \
             NO        YES
             |          |
             v          v
       Check VLAN,    Check routing,
       L2, target,    firewall,
       duplicate IP   destination

This simple model helps isolate Layer 2 resolution from Layer 3 routing.

ARP vs DNS

ARP and DNS are sometimes confused because both perform forms of “resolution.”

But they solve completely different problems.

DNS

Maps names to IP-related information:

example.com
      |
      v
93.184.216.34

ARP

Maps a local/on-link IPv4 address to a link-layer address:

192.168.1.20
      |
      v
BB:BB:BB:BB:BB:BB

A simplified communication chain might therefore be:

Domain Name
    |
    | DNS
    v
IP Address
    |
    | Routing decision
    v
Next-hop IPv4 address
    |
    | ARP
    v
MAC Address
    |
    | Ethernet
    v
Local frame delivery

For the name-resolution layer, see DNS Explained.

ARP vs DHCP

DHCP and ARP also serve different purposes.

DHCP can provide configuration such as:

IP address
Subnet mask/prefix
Default gateway
DNS servers

ARP then helps the IPv4 host resolve appropriate local neighbors.

Conceptually:

DHCP
   |
   v
"Your IP is 192.168.1.20
Your gateway is 192.168.1.1"
   |
   v
ARP
   |
   v
"What MAC address belongs to 192.168.1.1?"

If DHCP provides an incorrect subnet mask or gateway, ARP behavior can consequently appear abnormal.

ARP vs IPv6 Neighbor Discovery

IPv6 does not use ARP.

Instead, IPv6 uses Neighbor Discovery, based on ICMPv6, for functions including neighbor address resolution.

Conceptually:

IPv4
→ ARP

IPv6
→ Neighbor Discovery Protocol

This is a critical distinction when troubleshooting dual-stack networks.

If IPv6 connectivity is failing, searching only the ARP table may tell you nothing about the failing IPv6 neighbor relationship.

ARP Troubleshooting Checklist

When investigating a suspected ARP problem, collect:

Source IP:
Source MAC:
Source VLAN:
Subnet mask/prefix:
Default gateway:
Destination IP:
Destination local or remote:
Expected target MAC:
Actual ARP entry:
Neighbor state:
Switch port:
Switch MAC-table entry:
ARP request visible:
ARP reply visible:
Duplicate IP suspected:
Recent failover:
Recent VLAN change:
Recent NIC replacement:
Proxy ARP enabled:

This converts:

“The server is unreachable.”

into a structured network diagnosis.

ARP Best Practices

ARP is largely automatic, but network architecture determines how reliable and secure the environment is.

Useful practices include:

Maintain accurate IP-address management.
Avoid manually assigned duplicate addresses.
Keep VLAN and subnet boundaries consistent.
Monitor unexpected MAC movement.
Investigate frequent ARP changes.
Use DHCP Snooping and Dynamic ARP Inspection where appropriate.
Protect network access at the switch edge.
Document virtual IP and high-availability behavior.
Verify gratuitous ARP behavior during failover testing.
Avoid unnecessary Proxy ARP.
Use packet captures when neighbor resolution is unclear.
Do not treat clearing the ARP cache as a permanent repair.

The most important operational principle is:

Understand why the ARP mapping is wrong before deleting it.

Frequently Asked Questions

What does ARP stand for?

ARP stands for Address Resolution Protocol.

What does ARP do?

In common IPv4 Ethernet networks, ARP resolves an on-link IPv4 address into the link-layer address needed for local frame delivery.

Is ARP Layer 2 or Layer 3?

ARP operates at the boundary between network-layer IPv4 addressing and link-layer delivery. Different networking models classify it differently, so calling it strictly “Layer 2” or strictly “Layer 3” can oversimplify its role.

What is an ARP request?

An ARP request asks which device owns a particular protocol address and requests its hardware address.

Is an ARP request broadcast?

On Ethernet, a normal request for an unknown neighbor is typically carried in a broadcast frame.

What is an ARP reply?

It is the response providing the requested protocol-to-hardware address mapping.

Is an ARP reply broadcast?

A normal response to a conventional ARP request is generally unicast to the requester because the requester supplied its hardware address in the request.

What is an ARP table?

It is neighbor information associating IPv4 addresses with link-layer addresses.

What is the difference between an ARP table and a MAC table?

An ARP table maps IPv4 addresses to MAC addresses. A switch MAC table maps MAC addresses to switch ports.

Does a switch use ARP?

A Layer 2 switch primarily forwards Ethernet frames using its MAC address table. A multilayer switch can also use ARP for its Layer 3 interfaces and routing functions.

Does ARP cross a router?

Ordinary ARP broadcasts are limited to their local Layer 2 broadcast domain and are not normally routed between IP networks.

Does a computer ARP for a remote Internet server?

Normally no. It resolves the MAC address of the appropriate local next hop, usually the default gateway.

Why does my computer ARP for the gateway?

Because remote IP packets need to be delivered locally to the router that will forward them toward the destination.

What is gratuitous ARP?

It is an unsolicited ARP announcement/request mechanism commonly used to announce address information, update neighbor mappings, detect conflicts, and assist failover.

What is Proxy ARP?

Proxy ARP occurs when a router or another system responds to an ARP request on behalf of another destination.

What is ARP cache?

ARP cache is commonly used to describe stored IPv4-to-link-layer neighbor mappings.

Can ARP entries expire?

Dynamic neighbor information can age, transition through states, and be refreshed according to the operating system’s neighbor-management implementation.

What is an incomplete ARP entry?

It generally indicates that neighbor resolution has been attempted but a usable link-layer mapping has not yet been obtained.

Why would ARP requests receive no reply?

Possible causes include an offline target, wrong VLAN, wrong address, Layer 2 failure, port isolation, security controls, or incorrect network configuration.

What is ARP spoofing?

ARP spoofing involves sending misleading ARP information in an attempt to manipulate another system’s IP-to-MAC mapping.

What is ARP poisoning?

ARP poisoning generally refers to corrupting neighbor ARP information through forged or misleading ARP messages.

What is Dynamic ARP Inspection?

DAI is a switch security mechanism that can validate ARP messages against trusted binding information and reject invalid ARP traffic.

Does IPv6 use ARP?

No. IPv6 uses Neighbor Discovery mechanisms based on ICMPv6 instead.

Can duplicate IP addresses cause ARP problems?

Yes. Two devices claiming the same IPv4 address can cause inconsistent IP-to-MAC mappings and intermittent connectivity.

Can ARP cause a broadcast storm?

Normal ARP produces broadcast traffic, but ordinary ARP by itself should not be confused with a switching loop. Layer 2 loops or abnormal behavior can amplify broadcasts dramatically.

Does clearing ARP fix network problems?

It can force neighbor information to be relearned and is useful diagnostically, but it does not repair underlying causes such as duplicate IPs, wrong VLANs, routing problems, or attacks.

Conclusion

ARP is one of the mechanisms that connects IPv4 networking with Ethernet delivery.

At the IP layer, a host knows:

Destination IP
192.168.1.20

At the Ethernet layer, it needs:

Destination MAC
BB:BB:BB:BB:BB:BB

ARP provides the relationship:

IPv4 Address
      |
      | ARP
      v
MAC Address

For a local destination:

Host
  |
  | ARP for destination
  v
Local Host

For a remote destination:

Host
  |
  | ARP for next-hop gateway
  v
Router
  |
  | Routing
  v
Remote Network

This distinction explains many networking behaviors that initially seem confusing.

ARP also connects directly to other fundamental concepts:

ARP
 |
 +---- Ethernet switching
 |
 +---- MAC address tables
 |
 +---- VLANs
 |
 +---- Default gateways
 |
 +---- Routing
 |
 +---- High availability
 |
 +---- Duplicate IP detection
 |
 +---- Network security

When troubleshooting, avoid thinking of ARP as an isolated protocol.

An unanswered ARP request may indicate:

Wrong VLAN
Wrong subnet
Target offline
Layer 2 failure
Gateway problem

An incorrect ARP entry may indicate:

Duplicate IP
Failover
Proxy ARP
Stale neighbor state
ARP spoofing

And a correct ARP entry does not prove that the complete network path is healthy—it only confirms an important part of local neighbor resolution.

The most useful troubleshooting model is therefore:

Physical Link
      |
      v
VLAN / Layer 2
      |
      v
ARP Resolution
      |
      v
IP Routing
      |
      v
Firewall / ACL
      |
      v
DNS
      |
      v
Application

By testing each layer in order, ARP becomes one of the most useful diagnostic signals in an IPv4 network rather than another cache to clear whenever connectivity fails.

Continue with Computer Networking Explained for the networking foundation, TCP/IP Explained for packet routing, Routers, Switches and Network Devices for Ethernet forwarding, Network Security Basics for Layer 2 security concepts, and DNS Explained for name resolution.

For protocol-level details, consult the original RFC 826: An Ethernet Address Resolution Protocol. Linux administrators can also use the official ip-neighbour documentation to understand neighbor-table management and states.