ARP

What is ARP?

ARP (Address Resolution Protocol) is the network protocol a device on a local Ethernet network uses to find the MAC address that belongs to a known IP address, so that it can deliver a frame at Layer 2. ARP is defined in RFC 826 from November 1982 and is still used by virtually every IPv4 device, from office laptops to PLCs, HMIs and IO modules. Because the protocol has no authentication whatsoever, it is both indispensable and a well-known point of attack in OT networks.

Without ARP, a device with an IP address cannot send data over Ethernet: it knows which address it wants to reach, but not which network card.

🧠 How does ARP work step by step?

1. A device wants to send a packet to an IP address within its own subnet. If the destination is outside the subnet, it looks up the MAC address of its default gateway instead, usually a Router or Firewall.
2. It first checks its ARP cache: a table of recently learned IP-to-MAC mappings.
3. If the address is not there, it sends an ARP request as a broadcast to FF:FF:FF:FF:FF:FF: “Who has IP x.x.x.x? Tell me.”
4. Only the device holding that IP address answers with an ARP reply (unicast) containing its own MAC address.
5. The sender stores the answer in its cache and transmits the Ethernet frame.

One detail in RFC 826 makes ARP both efficient and vulnerable: a receiver updates an existing cache entry from any ARP message that names that IP address as the sender, even if it never asked for it. Nothing checks whether the sender is telling the truth.

ARP only works within the local broadcast domain; a Router or VLAN boundary stops ARP traffic.

🔧 What does an ARP message look like?

ARP runs directly on Ethernet with EtherType 0x0806, so it sits below IP. For IPv4 over Ethernet the message is 28 bytes long:

Besides request and reply, you will meet several variants in packet captures:

• Gratuitous ARP - a device announces its own IP/MAC mapping unprompted, for example after boot or during failover of a redundant server or router (VRRP does this when it takes over the virtual address).
• ARP probe - a request with sender IP 0.0.0.0 that a device uses to check whether an address is already in use (RFC 5227, July 2008). A DHCP client is also expected to check an offered address this way and decline it on a conflict.
• RARP and Inverse ARP - historic or niche variants (RFC 903 and RFC 2390). RARP was superseded by BOOTP and later DHCP.

IPv6 has no ARP at all: Neighbor Discovery (RFC 4861) takes over that job using ICMPv6 messages.

🏭 Where does ARP matter in industrial networks?

• Address conflict detection - in 2010 ODVA added Address Conflict Detection (ACD) based on RFC 5227 to the IP specification. A device that sees its address duplicated defends it or reports a conflict instead of silently losing traffic.
• Commissioning - after address assignment via BOOTP/DHCP or a configuration tool, ARP is the first protocol a PLC or drive uses to find the devices it talks to.
• Diagnostics - arp -a on an engineering workstation or SCADA server, or a capture in Wireshark, quickly shows which MAC address sits behind an IP. A MAC address that keeps changing for the same IP points to a duplicate address, a replaced device or an attack.
• Passive inventory - ARP broadcasts are visible on every switch port in the VLAN. Asset discovery and passive monitoring tools use them to build a list of IP/MAC pairs without active scanning; the first three bytes of the MAC address (the OUI) reveal the manufacturer.
• Redundancy - when a redundant server pair or router fails over, the new active node sends a gratuitous ARP so that clients immediately use the new MAC address.

Watch out for a common misconception: an ordinary Layer 2 Switch forwards frames based on its MAC address table, not on ARP. Only routers, Layer 3 switches and firewalls use an ARP table to reach the next hop.

⏱️ How long does a device remember an ARP entry?

Cache entry lifetimes differ widely between platforms. That explains many “it only works after a few minutes” situations after a device with the same IP address has been replaced.

If you replace a PLC or IO module with a unit that has the same IP address but a new MAC address, a router or firewall with a long timeout may keep sending to the old MAC for hours. A gratuitous ARP from the new device, or manually clearing the ARP table, fixes this.

🔄 What is the difference between ARP and DNS?

🔐 How do you secure ARP in an OT network?

Because ARP believes every answer, an attacker with access to the same broadcast domain can send forged ARP replies. This is called ARP spoofing or ARP poisoning, a form of spoofing and the classic stepping stone to a Man-In-The-Middle attack: traffic between HMI and PLC then flows through the attacker, who can read, alter or block it. Because many industrial protocols such as Modbus TCP lack authentication and encryption, this is particularly dangerous in OT.

A practical layered approach, in line with Defense in Depth and IEC 62443:

1. Shrink the broadcast domain - with network segmentation and VLANs, an infected laptop on the office network cannot send ARP messages to process control.
2. Limit who can connect - Port Security, MAC Binding and 802.1X stop an unknown device from joining the segment at all.
3. Validate ARP on the switch - Dynamic ARP Inspection checks ARP messages against the DHCP Snooping binding table; for static addresses, common in OT, you use static ARP ACLs.
4. Use static ARP entries where possible - on HMIs, engineering workstations, servers and gateways that talk to a fixed set of PLCs or safety PLCs. Record them in change management, because they must be updated whenever hardware is replaced.
5. Detect anomalies - an IDS or NDR solution with passive monitoring flags an IP address that suddenly gets a different MAC address; forward those alerts to your SIEM.

ARP is simple and powerful, but without additional security measures every device in the segment blindly trusts every neighbour.

❓ Frequently asked questions

Does ARP work across a router?

No, ARP only works within a single broadcast domain. For a destination outside the subnet, a device uses ARP to look up the MAC address of its default gateway, and the Router performs its own ARP lookup on the other side.

How do I view the ARP table on my computer?

On Windows, arp -a shows the ARP cache, and on Linux you use ip neigh. arp -d (Windows) or ip neigh flush all (Linux) clears the table, which helps after replacing a device that keeps the same IP address.

What is gratuitous ARP?

Gratuitous ARP is an ARP message in which a device announces its own IP and MAC address without being asked. It is used after boot and during failover of redundant routers or servers, so that other devices update their ARP cache immediately.

Does IPv6 use ARP?

No, IPv6 does not use ARP but Neighbor Discovery (RFC 4861), which performs the same task via ICMPv6. Neighbor Discovery has similar spoofing risks, which switches counter with features such as RA Guard and IPv6 snooping.

Why is ARP spoofing especially dangerous in OT networks?

With ARP spoofing an attacker reroutes traffic through their own device, and many OT protocols have no authentication or encryption. The attacker can therefore alter commands to a PLC or show the HMI false readings while the process keeps running.

What happens with a duplicate IP address?

With a duplicate IP address, two devices answer the same ARP request and the MAC address in other devices’ caches keeps flipping, so connections drop intermittently. Devices with address conflict detection according to RFC 5227, such as many IP devices, notice this and report the conflict.

📌 In summary

• ARP maps an IP address to a MAC address within a local subnet using a broadcast request and a unicast reply (RFC 826, 1982).
• Cache entries stay reachable for 15–45 seconds on Windows and Linux, but often hours on routers; this explains faults after hardware replacement.
• In OT, ARP supports address conflict detection, commissioning, diagnostics and passive asset discovery.
• ARP has no authentication: segmentation, Port Security, Dynamic ARP Inspection, static entries and monitoring limit the risk of spoofing.

ARP is the invisible link between IP and Ethernet: essential for every OT connection, but only safe in a small, monitored and segmented network.