034
Daily Dose of Curious
HOW IT WORKS
ARP has no way of checking whether an answer is true, which is why a device replying to questions that were not meant for it can quietly place itself in the middle of a conversation. Everything about the protocol assumes the local network is a room full of honest people.
It shouts. Your device knows the IP address it wants to reach but not the hardware address underneath it, so it asks everybody on the local network and waits for one answer.
What actually happens
Check what you already know
Every device keeps a small cache of recent address pairs. If the answer is in there, nothing goes on the wire at all.
Ask the whole segment
An ARP request goes to the broadcast address, so every device on the local network receives it. It says: who has this IP, tell me.
One device answers
The owner of that IP replies directly to the asker. Nobody else says anything — the rest simply discard the question.
Both sides write it down
The asker caches the answer. The answerer usually caches the asker too, since the question carried its address as well.
The clever bit
The question is broadcast and the answer is not. One frame reaches everybody, one frame comes back, and the whole network is quieter for it than if both halves had been shouted.
The words
- MAC address
- The hardware address burned into a network interface, used only within the local network.
- Broadcast
- A frame addressed so that every device on the local network accepts it.
Where this comes from
- RFC 826 — the Address Resolution Protocol
- ARP caches are held for minutes, not hours, and the exact life varies by operating system
This one is not an opinion. It is how the thing works, and these are what that rests on.