ARP and Neighbor Discovery: From an IP to a Local MAC

Routing produces a next hop IP: either the destination itself, if it is on the local subnet, or the default gateway, if it is not. Either way the link layer needs that machine’s MAC address and the IP layer has no idea what it is — the two address spaces are independent by design. Something has to resolve one into the other, on the local segment, without a server, and quickly enough not to matter.

The key move for off-link destinations bears repeating because it is where beginners stall: to reach 203.0.113.10 the host resolves the MAC of 10.0.0.1 (the gateway), not of the server. The IP header says 203.0.113.10; the Ethernet header says the gateway. It is the router’s job to take it from there. If you ip neigh on your laptop you will see entries for your gateway and a few local devices, and never for any internet host.

The Address Resolution Protocol is a request/reply over raw Ethernet frames (EtherType 0x0806), not over IP. The host broadcasts a request to ff:ff:ff:ff:ff:ff: "who has 10.0.0.1? tell 10.0.0.4". Every interface on the segment receives it; the one that owns 10.0.0.1 replies unicast: "10.0.0.1 is at aa:bb:cc:00:00:0a". Everyone else drops it (though many stacks opportunistically learn the requester’s mapping from the request, since it was free). The exchange costs one broadcast and one unicast, well under a millisecond on a LAN.

The answer goes into the ARP cache (ip neigh on Linux, arp -a elsewhere) with a state: REACHABLE while recently confirmed, STALE after a timeout (typically 30–60 s of no positive confirmation), DELAY/PROBE while being re-verified with a unicast request, FAILED if nothing answers. The cache is why ARP is cheap: one request per neighbour per minute or so, not per packet. Packets that need an unresolved entry are queued (a few of them) until the reply arrives — which is the small stall you see on the first ping to a new host and the reason ping sometimes reports the first reply as slower.

Gratuitous ARP — announcing your own IP → MAC without being asked — is how a host checks for duplicate addresses when it comes up and how a failover pair tells the switches and neighbours that a virtual IP has moved to a new MAC. Proxy ARP is a router answering for addresses it can reach, used to glue subnets together in ways best avoided.

ARP has no authentication. Any host on the segment can send a reply — solicited or not — claiming 10.0.0.1 is-at <attacker MAC>, and most stacks will update their cache. From then on the victim sends every off-link packet to the attacker, who forwards it to the real gateway and reads or alters everything in between: a textbook on-path attack, and the reason TLS matters even on "trusted" networks. The same trick against the gateway captures the return direction.

Defences live in the switches (dynamic ARP inspection, which validates replies against the DHCP lease table), in static ARP entries for critical hosts, and above the link layer in encryption. The symptom of an attack or a misconfiguration is the same: an ARP entry for the gateway whose MAC changes, and arp-scan or ip neigh showing two IPs with the same MAC.

IPv6 dropped ARP and replaced it with Neighbor Discovery (NDP, RFC 4861), a set of ICMPv6 messages carried *inside IPv6 packets* rather than in raw frames. The resolution step is the same shape with two differences. A Neighbor Solicitation is sent not to broadcast (IPv6 has no broadcast) but to the target’s solicited-node multicast address, ff02::1:ffXX:XXXX where the last 24 bits are copied from the target IP; that maps to the Ethernet multicast 33:33:ff:XX:XX:XX, so only interfaces whose addresses share those 24 bits process it — usually exactly one. The target answers with a Neighbor Advertisement carrying its link-layer address, and the requester stores it in the neighbor cache (ip -6 neigh), with the same REACHABLE/STALE/PROBE states.

Neighbor Discovery does more than ARP. Router Solicitation / Router Advertisement let a host find its gateway without DHCP: routers periodically multicast (and answer requests) with their address, the on-link prefix, the MTU, and whether the host should use DHCPv6. From the advertised prefix a host can build its own address — SLAAC (stateless address autoconfiguration): prefix + a 64-bit interface identifier, once derived from the MAC (EUI-64) and now usually random and rotated for privacy (RFC 8981 temporary addresses). Duplicate address detection is a Neighbor Solicitation for your own tentative address; silence means it is yours. Redirects tell a host of a better first hop. All of this is ICMPv6, all of it multicast, none of it ARP.

The practical consequences: filtering ICMPv6 breaks IPv6 *completely* — not just ping, but address resolution and gateway discovery — which is the most common way IPv6 is accidentally disabled. And the ARP spoofing problem returns as rogue Router Advertisements: any host on the segment can advertise itself as a router and become the default gateway for everyone; RA Guard on switches is the counterpart to ARP inspection.

Both protocols solve "IP → local MAC", both cache, both trust the segment. The differences are where the messages travel (raw frames vs ICMPv6 inside IP), who hears the question (everyone vs a tiny multicast group), and how much else the protocol does (nothing vs gateway discovery, autoconfiguration and duplicate detection).