Networking › Module 6 › Lesson 2
ARP — Finding Neighbors on a LAN
How devices map IP addresses to MAC addresses on a local network
Opening
IP names the host; the frame still needs a MAC
Your laptop decides the next hop is 192.168.1.1 (the gateway from ip route). Ethernet cannot send to an IP. It sends to a 48-bit MAC. ARP (Address Resolution Protocol) is the IPv4 LAN question: "Who has this IP? Tell me your MAC." ARP only works on the local link — the same broadcast domain. You never ARP a public website across the internet. You ARP the gateway; routers handle the rest with their own next hops. Because ARP has no cryptographic authentication, a lying answer can steer traffic. This lesson is defender knowledge: what a healthy mapping looks like, and what an unexpected gateway MAC change means. You will not poison anyone's cache. You will not run attack tools. You will read YOUR neighbor table and compare it to a gateway MAC you already trust.
1. Request, reply, cache — and why it stays on-LAN
When Host A (192.168.1.50) must send to Host B (192.168.1.10) on the same subnet, A checks its ARP cache. Miss: A broadcasts an ARP request — destination MAC ff:ff:ff:ff:ff:ff — "Who has 192.168.1.10? Tell 192.168.1.50." Every station in the VLAN hears it. Only the owner of .10 should unicast an ARP reply with its MAC. A caches IP→MAC and builds the Ethernet frame. Off-subnet traffic is different. A does not ARP 93.184.216.34. A ARPs the default gateway IP. The frame's destination MAC is the router's LAN MAC; the IP header still names the remote destination. That split is why a wrong gateway MAC is so dangerous: you think you are sending "to the internet," but Layer 2 is delivering to whoever answered ARP for the gateway IP. The cache exists so the LAN is not flooded with ARP for every packet. Entries age (REACHABLE, STALE, DELAY, FAILED on Linux). Incomplete/FAILED often means nobody replied — host down, wrong subnet, or filtering — not a license to scan the rest of the /24. IPv6 uses Neighbor Discovery (NS/NA), not ARP; the defender idea is the same: next-hop L2 address can be observed and should be stable for a given gateway.
2. MITM risk as defender knowledge — not a how-to
ARP replies are not signed. On a LAN you do not control, a host could send a gratuitous ARP or a forged reply claiming "the gateway IP is at MY MAC." If victims cache that lie, their outbound frames go to the liar, who may forward a copy onward (classic local man-in-the-middle). That is the RISK: confidentiality and integrity of anything not protected by end-to-end crypto, plus a chance to intercept cleartext or present a fake local service. HTTPS still helps for web; it does not make a poisoned gateway "fine" for every protocol. This course does not teach you how to poison. No attack commands. No ettercap. No arpspoof. No "lab" that injects ARP on a shared network. Detection, conceptual and practical on YOUR box: know the real gateway MAC (from the router sticker, admin page of a device you own, or a baseline you recorded when the LAN was healthy). Read arp -n or ip neigh. If the MAC for the default via IP suddenly changes to a strange vendor OUI, or flaps between two MACs, treat it as an incident signal — isolate, compare to the known-good, check for a rogue device on a network you administer. Managed networks add Dynamic ARP Inspection and DHCP snooping; home users still win by noticing "gateway MAC is not the box I bought."
3. Wrong vs right: attacking ARP vs reading your cache
Worked failure mode — confusing awareness with a weapon. Own machine / own VM / WSL / a LAN you administer. Never poison a café, school, or employer gateway.
Wrong
You search for ettercap, arpspoof, or "how to ARP poison the gateway" and run it on any Wi-Fi "to learn MITM." That is an attack on other people's traffic. Classroom curiosity does not authorize it. Gratuitous ARP as a weapon is out of scope here.
Right
ip route to name the gateway IP. ip neigh or arp -n to see which MAC that IP currently has. Record the pair when the network is healthy. If the gateway MAC changes without a router swap you know about, investigate as a defender — compare, document, segment untrusted devices. Do not send forged replies.
4. Practical: read YOUR neighbor table
Read-only. You are listing what this host already learned. You are not sending crafted ARP, not flooding, not targeting other stations. Match the default via from ip route to one line in ip neigh. That line is the first-hop L2 mapping this lesson cares about.
Command guide
ip neigh / arp -n — YOUR cache only
Gateway IP you already trust (from YOUR route table)
Command — copy this
ip route
default via <GW> dev <IFACE>
Neighbor / ARP cache on THIS host
Command — copy this
ip neigh ip neigh show command -v arp >/dev/null && arp -n || true
Defender read:
Optional command
Find <GW> in the neighbor table.
Note its MAC (lladdr …). Compare to the MAC you recorded from YOUR router (admin page / sticker / baseline). Unexpected change = investigate. Do not "fix" it by poisoning back.
NEVER: ettercap, arpspoof, farpd, or any ARP-inject tool NEVER: send gratuitous ARP to claim a neighbor's IP NEVER: scan the LAN for live MACs as a sport Awareness is a cache diff — not a packet craft.
Mission: gateway IP and its MAC on your cache
On your VM or WSL, run ip route and ip neigh (or arp -n). Write the default via IP and the MAC currently cached for it (if present). One sentence: why a sudden change of that MAC — without you replacing the router — is a defender alert, not a reason to run an attack tool. Own machine only. No poisoning.
Stuck? Ask Cyberlium AI Mentor
If ip neigh shows FAILED for the gateway, ask Cyberlium AI Mentor for a hint — not a poison recipe. Try: "Hint only: default via is 192.168.1.1 but ip neigh says FAILED — what should I check on MY link before assuming MITM?"
You now know ARP request/reply/cache, why it is link-local, and that a forged gateway MAC is a local MITM risk you detect by comparing ip neigh to a known-good — never by practicing poison. Next — DHCP — Automatic Addressing — how the host got that IP, gateway, and DNS in the first place, and why a rogue DHCP server is a related risk.
Knowledge Check
APPLY: Your host must reach 8.8.8.8. ip route shows default via 192.168.1.1. Which IP does ARP resolve on this LAN, and why not 8.8.8.8?
Multiple choice
Knowledge Check
APPLY: On a home LAN you administer, ip neigh shows the gateway IP at a MAC that does not match the router you photographed last month, and you did not replace hardware. Best defender move?
Multiple choice
Knowledge Check
APPLY: True or False: Gratuitous ARP / ARP poisoning how-tos, ettercap steps, and arpspoof belong in this lesson as required lab commands.
True or False