ARP // RFC 826

The Address Resolution Protocol maps an IPv4 address to a link-layer address on the local segment. It is a small, unauthenticated request/reply protocol: “who has this IP?” broadcast, then “that IP is at this MAC” unicast.

RFC 826 · ARP RFC 5227 · conflict detection EtherType 0x0806 28-byte message IPv4 + Ethernet no checksum
layer link · address resolution message 28 B fixed wrapper Ethernet II opcodes 1 request · 2 reply

01Message layout

224 bits · 28 bytes on Ethernet/IPv4

The fixed Ethernet/IPv4 ARP message is 28 bytes: two 16-bit type fields, two address-length bytes, a 16-bit opcode, then sender hardware/protocol addresses and target hardware/protocol addresses. The fields are sized by HLEN and PLEN, so the parser must not hard-code six and four without checking.

ARP is wrapped by Ethernet, not carried by IP

An ARP request is an Ethernet frame with EtherType 0x0806, usually sent to ff:ff:ff:ff:ff:ff. The 28-byte ARP message is padded to the 46-byte Ethernet payload minimum and protected by the Ethernet FCS. ARP has no IP header, no port numbers and no checksum.

02Opcodes & common messages

1 request · 2 reply

The opcode is a 16-bit field, so RARP, InARP and experimental variants share the same layout. Modern IPv4 LANs mostly use requests and replies; the rest are history, specialized transports or diagnostic tools.

OpcodeMessageMeaningReference
1ARP REQUEST“Who has target IP? Tell sender IP.” Usually broadcast.RFC 826
2ARP REPLY“Target IP is at sender MAC.” Usually unicast back to the requester.RFC 826
3RARP REQUEST“Who is my IP?” Reverse ARP; effectively obsolete.RFC 903
4RARP REPLYServer response carrying the client's IPv4 address.RFC 903
8InARP REQUESTInverse ARP: ask for a protocol address for a known hardware address.RFC 2390
9InARP REPLYInverse ARP response.RFC 2390
ARP probeSPA = 0.0.0.0A host checks whether an address is already in use before claiming it. The sender protocol address is deliberately zero.
Gratuitous ARPSPA = TPAAn unsolicited announcement or probe for the sender's own address. Used for duplicate detection, failover and cache refresh.
ARP spoofingno authAny host can claim any IPv4 address. Dynamic ARP Inspection, static entries and segmentation limit the blast radius.
ARP is unauthenticated by design

There is no signature, nonce or checksum in the ARP message. Attackers on the same broadcast domain can poison caches and intercept traffic. Encryption at higher layers protects confidentiality, not the ARP mapping itself.

03Encoder

raw ARP or Ethernet-wrapped

Build a 28-byte Ethernet/IPv4 ARP message. The default wraps it in an Ethernet II frame with broadcast destination, padding and FCS so it matches a complete on-wire request. Untick the wrapper for the raw ARP message.

ARP parameters

RFC 826

For a request the Ethernet destination is normally broadcast; for a reply it is the requester's MAC. The ARP target MAC is all zero in a request, because that is the value being resolved.

wire output

waiting
Set the fields and press Build ARP.
output hex
no bytes built yet
ARP does not carry a checksum

The Ethernet FCS protects the frame in transit. A complete ARP request will normally be padded to the 46-byte Ethernet payload minimum; that padding is not part of the ARP message.

04Decoder

raw ARP or Ethernet frame

Paste raw ARP bytes or a complete Ethernet frame with EtherType 0x0806. The decoder detects the Ethernet wrapper, VLAN tags and padding, then reads the ARP addresses using HLEN and PLEN rather than assuming six and four.

parse bytes

RFC 826 · Ethernet wrapper
No ARP message decoded yet.

05Wire notes

what every LAN operator eventually learns
ARP is link-local

ARP resolves an IPv4 address only for the next hop on the same link. A router answers ARP for its own interface, not for a remote destination. IPv6 uses Neighbor Discovery instead of ARP.

  • The message is 28 bytes for Ethernet/IPv4. HLEN=6 and PLEN=4. A receiver must still read HLEN and PLEN before slicing addresses; other link layers use different lengths.
  • Requests are broadcast, replies usually unicast. The ARP target MAC is all zero in a request; that is the answer being requested. The Ethernet destination is broadcast in the usual case.
  • Ethernet padding is not ARP. A 28-byte ARP message inside a 46-byte minimum payload has 18 trailing zero bytes. Parse ARP by its own length, not by the frame end.
  • ARP has no checksum or authentication. The Ethernet FCS detects accidental corruption; it does not prevent cache poisoning or spoofing.
  • ARP probes and gratuitous ARP use the same fields. A probe uses sender IP 0.0.0.0. A gratuitous announcement uses sender IP equal to target IP. RFC 5227 defines IPv4 address conflict detection.
  • InARP and RARP share the format. The hardware and protocol type fields make ARP extensible, but RARP is obsolete and InARP is specialized to transports such as Frame Relay.
  • Watch the cache, not just the packet. Linux exposes neighbor entries through ip neigh; arp_ignore and arp_announce change how the kernel responds to ARP.

References

next protocol IPv4 header & options ->