Network › Module 6 › Lesson 1
How ARP Maps IP to MAC
IPv4 still needs a MAC on the local link — then read THIS host's map.
Visual · arp_ip_to_mac
ARP is YOUR host's IP→MAC notebook for this link. Original Cyberlium.
Opening
The packet names an IP. The frame on this Wi-Fi still needs a hardware address.
IPv4 is a name for a host. Ethernet and Wi-Fi still deliver to a 48-bit MAC. Address Resolution Protocol is how THIS computer fills that gap on the local link: it asks, quietly, which neighbor currently claims an IP, then writes the answer in a cache. You already use that cache every time you talk to a gateway. Most people never open it. This is ORIGINAL Cyberlium Topic 11 teaching — not a CEH lab, not a café MITM kit, not a warrant to rewrite anyone else's neighbor table. Practical work starts by identifying
1. Two addresses, one hop: IP in the header, MAC on the wire
When THIS host sends to an IPv4 neighbor on the same subnet, the IP header still names that neighbor. The Layer-2 frame cannot. It needs a destination MAC. ARP is the IPv4 question that fills the blank: who currently answers for this IP on this broadcast domain? The reply is cached so the LAN is not asked again for every packet.
Off-subnet traffic is a different sentence. You do not ARP a public website across the internet. You ARP the default-gateway IP on YOUR link. The frame's destination MAC is that first hop. The IP header still names the remote host. Mix those two and you will think you “talked to example.com” when you only handed a frame to whoever currently owns the gateway row.
Command guide
Two addresses, one hop: IP in the header, MAC on the wire
═══ COMMANDS ═══
Command — copy this
arp -a
2. The cache is a notebook, not a cryptographic proof
Entries age. Windows Neighbor Discovery and Linux ip neigh use states such as Reachable, Stale, and Unreachable. A Stale row is not an attack by itself — it is a cache that has not been confirmed lately. Incomplete often means nobody answered: host down, wrong subnet, or filtering. It is not a license to probe the rest of a /24.
IPv6 uses Neighbor Discovery instead of ARP. The defender idea is the same: THIS host stores a next-hop Layer-2 address for a next-hop Layer-3 address, and that pair can be read. Cyberlium stays on reading YOUR table. Café “find every MAC” blogs are out.
Command guide
The cache is a notebook, not a cryptographic proof
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install dnsutils
macOS: Built-in
Windows: Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
powershell.exe -NoProfile -Command "Get-NetNeighbor | Select-Object IPAddress,LinkLayerAddress,State,InterfaceAlias | Format-Table -AutoSize" || ip neigh show
3. Name YOUR gateway IP, then find that one row
The row that matters for “I thought I reached the internet” is the mapping for YOUR default-gateway IP. Get that IP from THIS host's route table, then look it up in the ARP/neighbor list. That is defender literacy. It is not a hunt for other stations.
first in heading 1. If 192.168.0.1 was a router login, you already STOPPED. Teaching bind for this module is You still do not log into a home gateway “because ARP mentioned it.”
Command guide
Name YOUR gateway IP, then find that one row
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: ifconfig
Windows: Use: ipconfig
═══ COMMANDS ═══
Command — copy this
powershell.exe -NoProfile -Command "Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object NextHop,InterfaceAlias | Format-Table -AutoSize" || ip route || route print | head -n 40
4. What you ship: a named IP→MAC sentence for THIS host
Write: same-subnet traffic ARPs the neighbor; off-subnet traffic ARPs YOUR gateway IP. and STOP if it is Router Admin. Keep notes chmod 600. Do not treat ARP as a scanner. Bind teaching work to
5. What you record before the next lesson
Date (UTC). ARP = THIS host's IP→MAC notebook on this link. DEMO identified or STOPPED if router. SAFE NEVER nmap the LAN, ettercap, or arpspoof. Path: $HOME/cyberlium-lab/t11-m06-l01-arp-map.txt. Legal: original Cyberlium — not a vendor LAN cert.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
nmap 192.168.0.0/24 “to fill the ARP table.” Log into the home router because 192.168.0.1 answered. Run a GitHub ARP-spoof gist on café Wi-Fi “to see MACs.”
Right
with curl. Read arp -a / Get-NetNeighbor on THIS host. Write same-subnet vs gateway-row in cyberlium-lab. Next: Poisoning as an Idea Not a Cookbook.
Mission: name the map on YOUR host
1) curl http://192.168.0.1/ and decide lab-app vs router (STOP if router). 2) Run arp -a or Get-NetNeighbor on THIS computer. 3) Write one sentence: off-subnet traffic uses the gateway's MAC, not the website's. Never scan the LAN. Never send ARP replies.
Stuck? Ask Cyberlium AI Mentor
If arp -a is empty on a VM with no gateway, ask Mentor: “Hint only: how do I show neighbor state on this OS?” — not how to discover every host on a café /24.
Knowledge Check
APPLY: Your browser loads https://example.com. On YOUR Wi-Fi, which MAC does the Ethernet/Wi-Fi frame actually need for the first hop?
Multiple choice
Knowledge Check
APPLY: True or False: ARP proves the neighbor is honest because replies are cryptographically signed.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ shows a Netgear “Router Admin” page. What do you do before reading ARP?
Multiple choice