ARP

/arp/ · noun · Development · Origin: 1982

Definitions

  1. Address Resolution Protocol — a Layer 2 protocol that maps IP addresses to MAC (hardware) addresses on a local network. When a device needs to send a packet to a local IP, it broadcasts an ARP request asking 'who has this IP?' and the owner responds with its MAC address. ARP spoofing is a common attack vector on local networks.

    In plain English: A protocol that figures out which physical device on your local network corresponds to a given IP address — like looking up someone's street address from their name.

    Example: The penetration tester used ARP spoofing to position themselves as a man-in-the-middle on the conference Wi-Fi network.

Etymology

1982
David Plummer published RFC 826, defining the Address Resolution Protocol for mapping network-layer addresses (IPv4) to link-layer addresses (MAC) on local networks.
1990s
ARP became fundamental to Ethernet networking. Every device on a LAN relied on ARP to discover its neighbors' hardware addresses before sending packets.
2000s
ARP spoofing and poisoning attacks became a well-known security concern. Tools like Ettercap demonstrated man-in-the-middle attacks exploiting ARP's lack of authentication.
2017
IPv6 networks replaced ARP with the Neighbor Discovery Protocol (NDP), but ARP remains essential in the vast majority of IPv4 networks worldwide.

Origin Story

The protocol that shouts 'who has this IP?' on your local network

David Plummer invented the **Address Resolution Protocol** in 1982 (RFC 826). The problem: Ethernet uses MAC addresses (physical, hardware-level), but IP uses IP addresses (logical, network-level). Something had to translate between them.

ARP's solution is elegantly simple: when a device needs to find the MAC address for an IP, it broadcasts "Who has 192.168.1.1?" to every device on the local network. The owner replies "That's me, and my MAC is AA:BB:CC:DD:EE:FF." Results are cached to avoid constant shouting.

ARP's trusting nature (any device can claim any IP) led to **ARP spoofing**, a fundamental attack in network security. An attacker can claim to be the gateway, intercepting all traffic. This is why public WiFi networks are inherently risky.

Coined by: David Plummer

Context: RFC 826, 1982

Fun fact: Plummer wrote the ARP RFC while at MIT. The protocol is so simple that the entire specification is only 9 pages long, including examples. It's one of the shortest and most consequential RFCs ever published.

Related Terms