What Is ARP? How IPs Get Matched to Real Devices
Here's a gap in the story of how networks work: your laptop knows the printer's IP address, but Wi-Fi and Ethernet don't deliver by IP — they deliver frames to MAC addresses. Something must translate "who has 192.168.1.105?" into "the device with MAC A4:83:E7:2B:91:0C." That something is ARP — the Address Resolution Protocol.
How ARP works
- Your laptop wants to reach
192.168.1.105and doesn't know its MAC. - It broadcasts to the whole local network: "Who has 192.168.1.105? Tell 192.168.1.10."
- The printer replies directly: "192.168.1.105 is at A4:83:E7:2B:91:0C."
- Your laptop caches the answer in its ARP table and sends the print job to that MAC.
Entries expire after minutes, so tables stay fresh as devices come and go. Note ARP only exists on the local network — traffic for the internet just needs the gateway's MAC, and beyond your router, routing takes over. (IPv6 replaces ARP with Neighbor Discovery — same job, newer machinery.)
Seeing your ARP table
arp -a
Works on Windows, Mac and Linux — it lists every local IP↔MAC pairing your device currently knows. Practical uses:
- Finding devices — the MAC's vendor prefix identifies manufacturers, handy for locating a printer or spotting unknown gadgets on your Wi-Fi.
- Diagnosing conflicts — an IP conflict shows up as one IP flapping between two MACs.
- Checking a silent host — a device that won't answer ping may still appear in ARP, proving it's alive on the network.
ARP spoofing: the protocol's dark side
ARP has no authentication — any device can answer any query, and most systems accept unsolicited "updates." An attacker on your network can claim the gateway's IP maps to their MAC, silently routing everyone's traffic through themselves: a classic man-in-the-middle. Tools to do this are point-and-click.
What actually protects you:
- Encryption above the network layer — HTTPS and VPNs keep intercepted traffic unreadable; the attacker sees ciphertext.
- Trusted networks — ARP spoofing requires being on your network, so a strong Wi-Fi password matters, and public Wi-Fi deserves a VPN.
- Managed-network defences — enterprise switches offer dynamic ARP inspection; home users rely on the two lines above.
Frequently asked questions
Why does arp -a show devices I don't recognise?
Every phone, TV, plug and speaker on your Wi-Fi appears. Look up each MAC's vendor prefix; if something truly doesn't belong, change your Wi-Fi password.
Is ARP the reason my network is slow?
Almost never — ARP traffic is tiny. Slowness lives elsewhere: Wi-Fi signal, congestion, or your uplink. ARP problems cause outright unreachability, not slowness.