ARP and Layer 2 Fundamentals
How devices find each other on the same local network.
Key takeaways
- MAC addresses identify physical network interfaces; used at Layer 2.
- ARP maps IP addresses to MAC addresses on a local segment.
- ARP is unauthenticated — making ARP poisoning a viable attack vector.
- SOC analysts look for ARP anomalies as indicators of man-in-the-middle attacks.
Before a packet can be delivered on a local network, the sending host needs to know the MAC address of the next hop. That's where ARP comes in — it broadcasts "who has IP 10.1.1.1?" and the owner responds with their MAC address.
The problem: ARP is completely unauthenticated. This is the basis of ARP poisoning attacks.
Keep reading — it's free
Register once to unlock every lesson in the Vijilan Cybersecurity Academy, track your progress, and earn domain badges toward the certification. No cost, no sales pitch.
- Every lesson, free
- Progress tracking
- Domain badges
- No credit card