What is ARP?

Address Resolution Protocol (ARP) maps a device’s IP address to its hardware MAC address so two devices on the same Ethernet segment can exchange frames. A device broadcasts an ARP request for an IP address, the owner replies with its MAC address, and the requester caches that mapping.

Key takeaways

• ARP resolves IP addresses to MAC addresses on a local network segment.
• A broadcast ARP request draws a unicast reply, which then gets cached.
• Proxy ARP lets one device answer ARP requests on another device’s behalf.
• ARP suppression stops broadcast ARP flooding across EVPN/VXLAN fabrics.
• Versa Director can display ARP entries, including MAC address and hardware type.

On this page: Why it matters · How it works · Types · ARP & Versa · FAQ

Why is ARP important?

ARP turns Layer 3 addressing into something an Ethernet network can actually deliver. IP routing decides which subnet a packet belongs on, but frames only move across a LAN using MAC addresses – so before a host can reach a peer on the same segment, it needs an ARP exchange to learn that MAC address. Without it, IP could not function on Ethernet.

That dependency also makes ARP security-relevant. Standard ARP has no built-in authentication, so a host can claim any IP-to-MAC mapping it wants – the basis of ARP spoofing and man-in-the-middle attacks on local networks. And because ARP requests are broadcast, large or virtualized networks, especially EVPN/VXLAN fabrics spanning many sites, can see real overhead if ARP isn’t optimized.

What is ARP?

ARP operates directly inside Ethernet frames – its own EtherType, no IP header – and works only within a single broadcast domain, since requests do not cross routers. When a host needs to reach a destination on its local subnet, it first checks its ARP cache. If no entry exists, it broadcasts an ARP request (“Who has 10.0.0.5? Tell 10.0.0.1”) to every device on the segment. The owner responds with a unicast ARP reply, and the requester caches the mapping so it doesn’t repeat the lookup for every packet.

Routers and Layer 3 switches maintain their own ARP tables per connected subnet, refreshing entries before they expire. Because entries age out, ARP self-heals after a NIC swap or IP reassignment – the next packet just triggers a fresh exchange.

Types of ARP

Dynamic ARP is the default: entries are learned from request/reply exchanges and expire on a timer, keeping the table current automatically. Static ARP entries are configured by hand, binding an IP address permanently to a MAC address – useful for devices that must never be spoofed. Proxy ARP lets one device answer requests on behalf of another, so a requester reaches an address that actually sits elsewhere. Gratuitous ARP is a host announcing its own mapping unprompted, used to detect address conflicts and refresh caches after a failover, such as a VRRP backup taking over a virtual IP.

A fifth pattern matters on modern fabrics: ARP suppression. Instead of every request flooding an EVPN/VXLAN network, locally learned mappings are advertised directly to remote peers, which answer locally on the fabric’s behalf.

ARP & Versa

On VOS devices, ARP is configurable, not just a background protocol you can’t touch. Interfaces expose a Static ARP tab on physical interfaces and subinterfaces, binding a host IP address to a MAC address by hand. A Proxy ARP tab (Release 21.2.1+) lets a VOS device answer requests for addresses in NAT pools inside or outside the interface’s subnet, replying with the port’s physical MAC; if the interface’s VRRP state is not active, the device withholds those responses.

On EVPN/VXLAN fabrics – used to build Zero Trust LAN segments and for general Layer 2 forwarding – ARP suppression (Release 22.1.1+) stops requests from flooding every peer: locally learned entries are advertised across the EVPN network, and peers perform proxy ARP for remote hosts. IRB interfaces, routing between a Layer 3 network and a bridge domain, are discovered by other switches through an ordinary ARP request. Versa Director displays a network’s ARP entries, including interface name, MAC address, and hardware type.

Frequently asked questions

What is the difference between ARP and RARP?

ARP resolves an IP address to a MAC address; RARP does the opposite – a device broadcasts its known MAC address to ask for its IP address, once used by diskless workstations at boot. RARP is obsolete; DHCP now handles that job.

How does an ARP request and reply work?

A host broadcasts an ARP request asking “who has this IP address,” and every device on the segment receives it. Only the owner replies, sending a unicast ARP reply with its MAC address, which the requester then caches.

What is ARP spoofing?

ARP spoofing is an attack where a host sends forged ARP replies to associate its own MAC address with another device’s IP address – often the gateway’s – redirecting traffic through the attacker. It works because standard ARP has no authentication.

What is proxy ARP?

Proxy ARP is when a device answers ARP requests on behalf of another host that isn’t directly reachable on the same segment. Traffic ends up at the proxy’s MAC address, which forwards it onward – useful for reaching NAT pools without renumbering.

What is ARP suppression?

ARP suppression stops ARP requests from being broadcast across an entire EVPN/VXLAN fabric. Locally learned IP-to-MAC mappings are advertised to all EVPN peers instead, who answer requests locally through proxy ARP, cutting broadcast traffic on large fabrics.

More on ARP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ARP, these are worth looking at next.