What is the Address Resolution Protocol (ARP)?

How Does Address Resolution Protocol (ARP) Work?

When a computer joins a local area network (LAN), it is assigned an IP address. This may be a static IP address that remains unchanging or a dynamic one assigned by a DHCP server. When a packet destined for that computer passes through a network gateway, the gateway needs to determine where to send it, which requires the MAC address. A network gateway will keep a lookup table — called the ARP cache — that lists all known IP/MAC address mappings.

If the desired mapping exists in the ARP cache, then the gateway can send the packet to its destination. However, an IP address may not exist in the cache if it is new or if it has been purged (address mappings are typically cached for only a few minutes). In these cases, the gateway needs to find out which MAC address maps to that IP address.

This is where ARP comes into the picture. A gateway will broadcast an ARP request to all computers on the LAN asking which of them is using that IP address. The computer with that IP address will send back an ARP response that provides its MAC address. When the gateway receives this ARP response, it can send the packet on to its intended destination. It will also record the IP/MAC address mapping in its ARP cache so that it can properly route packets in the future.

Types of ARP

The core ARP protocol discovers the MAC address associated with an IP address on an as-needed basis. Some other variations of the protocol include:

• Proxy ARP: Proxy ARP extends ARP beyond a particular LAN. A device that knows how to route traffic to the intended destination will provide its MAC address in response to an ARP request and forward any packets sent to it.
• Gratuitous ARP: Typically, an IP/MAC address mapping is only sent out in response to a request from the gateway. With gratuitous ARP, a device announces its IP/MAC address mapping without being asked.
• Reverse ARP (RARP): ARP is used to determine the MAC address associated with an IP address. RARP is used by devices that don’t know their IP addresses to discover them.
• Inverse ARP (IARP): While RARP is used by a device to find its own IP address based on a MAC address, IARP can be used by another device to learn the IP address of a device given its MAC address.

ARP and Check Point Solutions

ARP is a foundational network protocol that is crucial to network routing. Without it, gateways must be manually configured to map IP addresses to MAC addresses, dramatically reducing the usability of a network and the benefits of DHCP and similar protocols.

Check Point’s vast experience in network security and firewall development has provided it with a deep understanding of network protocols, and it uses these protocols in its solutions. For instance, Check Point clustering and dynamic routing technologies use ARP to provide resilient network security. Also, Check Point’s Quantum IoT Security uses device MAC addresses obtained via ARP as part of a device’s overall network fingerprint, then enriches this with cloud AI/ML engines to map IoT devices to a zero trust profile.

Check Point next-generation firewalls provide comprehensive network protection and make full use of available protocols. To learn more about what to look for in an NGFW, check out this buyer’s guide. Then, see the capabilities of Check Point NGFWs for yourself with a free demo.