In this guide
ARP basics
IPv4 hosts use the Address Resolution Protocol (ARP) to discover the MAC address associated with an IPv4 address on the local Layer 2 network. A host broadcasts an ARP request asking which device owns an address; the owner normally responds with an ARP reply containing its MAC address.
ARP is a local-link mechanism. A host does not ARP for a remote internet server. It ARPs for its default gateway, then sends the IP packet to the gateway's MAC address.
Who has 192.168.10.1? 192.168.10.1 is at aa:bb:cc:dd:ee:ff
ARP caches
Hosts cache resolutions so they do not need to broadcast an ARP request for every packet. Entries expire or are refreshed according to the operating system and network implementation.
Useful commands vary by platform. On Linux, ip neigh displays neighbour state; on Windows, arp -a shows the ARP cache. Network switches and routers also expose ARP tables, although those tables represent the device's own Layer 3 observations.
| Observation | Possible meaning |
|---|---|
| Incomplete/failed neighbour entry | The host is attempting resolution but is not receiving a usable response. |
| Unexpected MAC for gateway | Proxy ARP, gateway change, duplicate address or a security issue may be involved. |
| Same IP associated with different MACs | Investigate duplicate addressing, failover, virtualisation or spoofing. |
Gratuitous ARP
A gratuitous ARP is an ARP message sent without being prompted by an ordinary request. Devices can use it to announce or refresh an IP-to-MAC association, particularly after an interface comes online or a highly available service moves between devices.
Gratuitous ARP can also help detect duplicate addresses. A host may announce its own address and observe whether another device responds or conflicts.
Duplicate IP addresses
Two devices using the same IPv4 address can cause intermittent and confusing failures. Different switches or hosts may learn different MAC associations for the same IP, and traffic can alternate between devices as ARP information changes.
Typical symptoms include intermittent access, sessions dropping, printers or gateways appearing to “move”, and MAC/ARP entries changing unexpectedly. Capture ARP traffic and correlate it with switch MAC tables when the fault is difficult to reproduce.
IPv6 Neighbour Discovery
IPv6 does not use ARP. It uses Neighbour Discovery Protocol (NDP), carried in ICMPv6. NDP supports neighbour address resolution, router discovery, neighbour reachability detection and other functions.
Neighbour Solicitation and Neighbour Advertisement messages provide address resolution. Router Solicitation and Router Advertisement messages help hosts discover IPv6 routers and network configuration. This is why blocking ICMPv6 indiscriminately can break much more than ping.
| IPv4 | IPv6 |
|---|---|
| ARP request/reply | Neighbour Solicitation/Advertisement |
| Broadcast request | Multicast-based discovery |
| ARP cache | Neighbour cache |
| Router discovery commonly separate mechanisms | Router Advertisements are part of NDP |
Switch MAC learning
ARP tells a host which MAC to use; the switch then uses its MAC address table to determine which port should receive the Ethernet frame. These are related but separate pieces of state.
A switch does not need to know the IP address to forward an ordinary Ethernet frame. It learns source MAC addresses from received frames and forwards based on destination MAC and VLAN. This distinction is particularly useful when troubleshooting: an IP-to-MAC problem can exist even when the switch's MAC table is perfectly healthy.
Troubleshooting resolution failures
- Check the host's IP address, prefix and default gateway.
- Determine whether the destination is local or remote.
- For a remote destination, inspect resolution of the default gateway.
- Check the ARP or neighbour cache.
- Check the switch MAC table for the relevant MAC and VLAN.
- Capture ARP or ICMPv6 NDP traffic if resolution is incomplete.
- Look for duplicate IP announcements or unexpected MAC addresses.
- Check VLAN membership and Layer 2 reachability.
- Only after resolution is working, move on to routing, firewall and application testing.
Key takeaways
IP packets still need an Ethernet or equivalent Layer 2 destination on a local link. ARP provides that bridge for IPv4; NDP provides it for IPv6. Understanding these tables and messages turns many mysterious intermittent connectivity faults into observable state changes.