ARP Table

What Is an ARP Table?

An ARP table holds the IP and MAC address pairs a device has picked up from neighbors on its local network. Before sending a frame, the device looks there first.

Here's a single line from arp -a on a Windows laptop, piece by piece:

• 192.168.1.1: the IP address of the gateway

• 3c-52-82-1a-9f-00: the MAC address that answered for that IP

• dynamic: the laptop learned the pair on its own from an ARP reply

Hosts keep one. So do routers, firewalls and Layer 3 switches. You'll often hear it called the ARP cache, because nothing in it lasts long.

Why two addresses at all? The IP address picks the network. Once the frame gets there, the MAC address picks the exact network card.

What Is ARP (Address Resolution Protocol)?

Address Resolution Protocol (ARP) is how a device on a local network learns which MAC address goes with a given IPv4 address. Each answer becomes one row in the ARP table. It is a network protocol with a single job and a fixed message format.

The IP address usually comes from an application or a DNS lookup, but an Ethernet frame can't leave without a destination MAC. ARP gets one by asking the whole segment. Three properties shape how ARP behaves:

• Local scope: ARP requests are broadcasts, and routers do not forward broadcasts, so ARP stays inside its subnet

• No authentication: any device on the segment can send a reply, and receivers accept it, which is the gap ARP spoofing exploits

• IPv4 only: IPv6 uses Neighbor Discovery Protocol for the same job, covered later on this page

Is ARP a Layer 2 or Layer 3 Protocol?

Textbooks disagree on this one. Its payload is a Layer 3 address, yet it travels in a Layer 2 frame. Because of that split across the OSI model, you'll see it called Layer 2.5.

Layer 2 is the more common answer. ARP messages travel straight inside Ethernet frames under EtherType 0x0806, and there's no IP header anywhere in them.

How Does ARP Work?

ARP asks the whole segment who owns an IP address, then keeps the answer. Here's what that looks like for a laptop at 192.168.1.50 reaching its gateway, 192.168.1.1, with nothing cached yet. There are five steps:

1. Cache lookup: The laptop checks its ARP table for 192.168.1.1, finds nothing and holds the outgoing packet.

2. Request broadcast: It sends an ARP request to the broadcast MAC address ff:ff:ff:ff:ff:ff, asking which device owns 192.168.1.1 and including its own IP and MAC.

3. Comparison on every host: Each device in the broadcast domain, usually one VLAN, compares the requested IP with its own. Devices without a match discard the request.

4. Unicast reply: The gateway sends an ARP reply straight to the laptop's MAC address, carrying its own MAC address.

5. Cache entry: The laptop writes the pair into its ARP table and sends the held packet. The gateway usually records the laptop's pair from the request too, so no second lookup is needed in the other direction.

What about a target on another network, like 10.0.5.20? A quick check against the subnet mask shows the address is remote, so the laptop asks for the gateway's MAC instead. The router handles the rest with its own ARP exchange on the other side.

ARP Packet Format and Fields

Nine fixed fields make up an ARP packet, identifying both sender and target by MAC and by IP. Requests and replies use the same layout. With Ethernet and IPv4, that adds up to 28 bytes.

Want to see them for yourself? Open a packet capture, filter on arp and look at any reply. Its sender fields hold the MAC address the requester asked for.

What Does an ARP Table Contain?

One row per neighbor. Column names change from one operating system to the next. The five fields underneath stay much the same.

Watch for INCOMPLETE. A request went out and nothing came back, so the row shows an IP next to an empty MAC field, and the usual cause is a target that's switched off or disconnected.

How Do You View an ARP Table?

You don't have to install anything. Windows, Linux, macOS and Cisco IOS each have a built-in command. The table lists the ones used most often.

Older Linux guides still show arp -n. That command now needs the net-tools package on most distributions, so ip neigh show is the safer habit. PowerShell suits Windows servers better, because you can pipe its output into a script.

Read the Age Column First

Watch whether the age resets. A value that keeps returning to 0 means the device sends traffic often, and that is expected from a gateway but odd from a printer.

An entry whose age climbs toward the timeout has gone quiet. Most of the time, that device has been unplugged or shut down.

Dynamic vs Static ARP Entries: What's the Difference?

A dynamic ARP entry comes from an ARP reply and expires by itself. A static one is typed in by an administrator, and it stays until somebody removes it. That difference changes how each one fails.

Most rows you will see are dynamic. Static entries are worth using only on a handful of devices that must never change, like the gateway or a core server, because no ARP reply can overwrite them. Each platform uses its own commands to add, remove and flush entries:

Windows requires an administrator prompt for all of these. No flush command touches a static entry.

Forged ARP replies can't overwrite it. The downside shows up later: if a server gets a new network card, the static entry still points at the old MAC, and nothing flags the mismatch.

What Is the ARP Cache Timeout?

The ARP cache timeout decides how long a learned entry is trusted. When it runs out, the device either deletes the entry or checks it again. Defaults vary widely by platform:

• Cisco IOS: holds entries for several hours per interface, changed with the arp timeout command in interface configuration

• Linux: an entry stays REACHABLE for a random period of roughly 15 to 45 seconds after the last confirmation, then moves to STALE and gets rechecked the next time traffic needs it

• Windows: follows the same reachable-time model, with a randomized reachable time in a similar range

• macOS: keeps an entry for up to about 20 minutes by default

Why does the gap matter? A router that holds entries for hours can keep sending frames to an old MAC after a host has moved, unless a gratuitous ARP corrects it. Short timers recover quickly, at the cost of more ARP traffic.

So where hosts move a lot, as on wireless or virtual machine VLANs, a lower Cisco timeout makes sense. Stable server VLANs can keep the default.

When Should You Flush an ARP Table, and How?

Flushing an ARP table wipes its dynamic entries. Within seconds, live traffic fills the table again, so a flush is a low-risk first move in three situations:

1. A server received a new network card, and neighbors still hold its old MAC address

2. A device moved to a new IP address, and the old pairing has not expired yet

3. Entries look poisoned, for example the gateway IP suddenly maps to an unfamiliar MAC

The flush command for each platform is in the static entries table above.

What Are the Four Types of ARP?

ARP comes in four types: gratuitous ARP, proxy ARP, Reverse ARP (RARP) and Inverse ARP (InARP). Gratuitous and proxy ARP are variations on the standard exchange. RARP and InARP are separate protocols, and both run the lookup in the opposite direction.

Gratuitous ARP

Gratuitous ARP reverses the usual order: the device announces its own address without being asked. Its sender IP and target IP are identical. Since it goes out as a broadcast, every neighbor on the segment updates its table at once.

Devices send one in these situations:

• At startup or when an interface comes up, to announce the pairing

• After an IP change or a network card replacement, so neighbors drop the old MAC

• During failover between redundant gateways or clustered servers, so traffic follows the shared virtual IP to the newly active device

The ARP probe is a close relative. Sent with 0.0.0.0 as the sender IP, it asks whether someone else already has the address. If anything answers, the address is taken and the host should not use it.

Proxy ARP

Under proxy ARP, a router answers ARP requests for hosts that live on another network. It hands out its own MAC address, so the traffic comes to the router first. The router then passes it on to the right destination.

Hosts with a bad subnet mask, or with no gateway configured, can still reach remote networks this way. It's on by default on many routers. Hardening guides usually say to switch it off, because it masks configuration errors and puts many IPs behind a single MAC.

Reverse ARP (RARP)

Reverse ARP worked the other way around: a device knowing only its MAC asked a local server for its IP address. Diskless workstations once used it at boot. BOOTP and later DHCP replaced it, and RARP is now obsolete.

Inverse ARP (InARP)

Inverse ARP finds the IP address of a remote device when its link-layer address is already known. Frame Relay and ATM networks needed it. There, a router knows which virtual circuit leads to the far end but not which IP address is assigned at the other end.

What Is ARP Spoofing and How Is It Prevented?

In an ARP spoofing attack, also called ARP cache poisoning, a device on the local network sends fake ARP replies linking its own MAC to someone else's IP. Nothing in ARP checks who sent a reply. Neighbors believe it and start sending that host's traffic to the attacker.

The gateway IP is the usual target. Poison that one entry and every victim's outbound traffic flows through the attacker, who can read it, hijack sessions or simply drop it. The ARP table tends to show the first warning signs:

• The gateway IP maps to a MAC address that differs from the gateway's known MAC

• One IP flips between two MAC addresses within a few minutes

• Several unrelated IPs map to the same MAC, and that MAC does not belong to a router

These controls prevent ARP spoofing or limit its reach:

• Dynamic ARP Inspection (DAI): the access switch checks every ARP packet against its DHCP snooping bindings and drops replies that do not match

• DHCP snooping: builds the trusted table of IP, MAC and switch port bindings that DAI depends on

• Static ARP entries: pin the gateway and critical servers so no reply can overwrite them, practical for a small number of devices

• Port security: limits each access port to one or a few known MAC addresses

• 802.1X and network access control: keep unknown devices off the segment in the first place

• Encryption: TLS and VPN tunnels keep intercepted traffic unreadable even if spoofing succeeds

Cisco IOS access switches need DHCP snooping in place before DAI will work. Both are enabled in global configuration:

One step is easy to miss. Uplinks and DHCP server ports have to be set as trusted. Use ip arp inspection trust and ip dhcp snooping trust in interface configuration, otherwise valid traffic on those ports gets dropped.

ARP in IPv6: How Neighbor Discovery Protocol Replaces ARP

IPv6 dropped ARP altogether. Neighbor Discovery Protocol (NDP) took over, using ICMPv6 messages, and hosts now keep a neighbor table that plays the same role.

The exchange mirrors ARP closely. One difference: NDP asks through a solicited-node multicast address, which means only hosts whose address shares the same last 24 bits process it. NDP also covers router discovery and address autoconfiguration, two jobs ARP never had.

States such as REACHABLE, STALE and PROBE mean the same thing here as in the Linux ARP table.

ARP vs DNS vs DHCP: What Is the Difference?

ARP turns an IP address into a MAC address on the local network. DNS works one step earlier, converting a hostname to an IP address. DHCP comes before both and hands the device its own IP.

In practice, all three run within seconds of each other. A laptop joining the network gets its address from DHCP first. Next comes a DNS lookup for the server name, and only then an ARP request for the gateway.

Some DHCP clients also run an ARP probe on the offered address before taking it, in case it's already in use.

ARP Table vs MAC Address Table vs Routing Table

Moving one packet can involve three different tables. It's easy to confuse them. One reason is that a single switch can hold all three at once.

On a Layer 2 switch, forwarding depends on MAC addresses only. Its ARP table has little in it beyond the switch's own management IP, at least until routing is enabled and entries appear for each routed VLAN.

What Can the ARP Table Tell You When Something Breaks?

If a local device stops responding, its ARP entry is a quick way to tell a Layer 2 fault from one higher up. Three checks cover most cases.

1. Ping the device, then read its ARP entry:

Ping the target first and check its entry afterward. An Incomplete status says ARP got no answer. In that case, the device is likely off, unplugged or on the wrong VLAN, so leave the firewall rules alone for now.

A complete entry with a failed ping means Layer 2 works. Check the host firewall or a routing rule next.

2. Watch for a MAC address that keeps changing under one IP:

When one IP keeps switching between two MAC addresses, the cause is nearly always a duplicate address. Often somebody has set a static IP inside a DHCP scope.

It is a different story when the gateway IP is the one flipping. Treat that as possible ARP spoofing and go through the spoofing checks earlier on this page.

3. Look for a sudden rise in Incomplete entries:

Has an access switch suddenly filled with Incomplete entries? Someone is probably scanning the network, since every address that goes unanswered in a sweep leaves one behind. Good network segmentation confines that scan to a single VLAN.

4. Pull ARP and MAC address tables from every switch into one view:

All of this happens one device at a time. With hundreds of switches, switch monitoring can collect the ARP and MAC address tables over SNMP and match them up. One IP lookup then returns the switch, port and MAC together.