Address Resolution Protocol: Function, Types & Security

Address Resolution Protocol translates IP to MAC addresses without authentication, enabling spoofing attacks. See how SentinelOne finds and stops ARP-based lateral movement.

What is Address Resolution Protocol (ARP)?

Address Resolution Protocol (ARP) translates IP addresses to MAC addresses in local networks without any authentication mechanism. To send traffic to an IP address on the same network segment, a system requires the corresponding hardware MAC address to deliver the packet at Layer 2. ARP broadcasts a request asking "Who has IP address X.X.X.X?" Systems accept responses from any device without verification, allowing attackers to claim any IP address and redirect traffic.

This process happens automatically when a system needs to communicate with another device on the local network, such as accessing internal file servers or routing traffic through the default gateway, unless the required MAC address is already cached from a previous ARP resolution. RFC 826, the protocol specification from 1982, defines how ARP resolves the fundamental addressing mismatch between Layer 3 (network layer) and Layer 2 (data link layer).

How Address Resolution Protocol Relates to Cybersecurity

ARP provides no authentication, encryption, or verification mechanisms. This trustless design lets attackers poison ARP caches without triggering any protocol-level validation.

NIST CVE-1999-0667 establishes the foundational vulnerability: "The ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service." This isn't an implementation bug you can patch; the protocol design requires compensating controls.

MITRE ATT&CK Technique T1557 documents that adversaries with network access manipulate traffic in real time using adversary-in-the-middle attacks enabled by ARP spoofing. Attackers who poison an ARP cache to position themselves between systems bypass Layer 3 security controls entirely. Layer 2 controls like Dynamic ARP Inspection validate packets at the source, while behavioral analysis and monitoring at Layer 3 and above can identify the credential theft and lateral movement that occur after successful ARP spoofing. SentinelOne's Singularity platform provides this behavioral correlation by connecting network-layer anomalies to endpoint activity patterns. ARP spoofing that enables lateral movement triggers Purple AI to identify suspicious authentication and process execution sequences indicating active compromise.

CISA documents ARP vulnerabilities in critical infrastructure and industrial control systems, highlighting risks beyond IT networks. The protocol's ubiquity means exploitation opportunities exist wherever attackers gain local network access, and Layer 3 security controls can't stop Layer 2 attacks within the same broadcast domain.

Real-world attacks demonstrate these protocol-level vulnerabilities. In the Target breach of 2013, attackers exploited ARP spoofing to map the internal network and enable lateral movement after gaining initial access through HVAC vendor credentials. The reconnaissance and network positioning contributed to the theft of 40 million credit card records and 70 million customer records, resulting in total costs of $202 million. During the Ukrainian power grid attack of 2015, APT actors used spear-phishing and network reconnaissance before deploying BlackEnergy malware. The multi-stage attack affected 225,000 customers across three energy distribution companies, as documented in ICS-CERT reports.

Understanding these protocol-level vulnerabilities requires examining the technical components that enable ARP's automatic address resolution.

Core Components of Address Resolution Protocol

Four components handle ARP resolution, and each one represents a potential attack surface. Attackers who gain local network access can manipulate any of them to redirect traffic:

• ARP Cache Tables: Most IPv4 networked devices maintain an ARP cache storing recent IP-to-MAC address mappings, with dynamic entries learned from ARP responses and, on some devices, static entries that can be manually configured.
• ARP Request Packets: A system needing a MAC address for an IP on the local subnet broadcasts an ARP request containing the source IP and MAC address, plus the target IP address being sought.
• ARP Reply Packets: The device with the requested IP address sends a unicast ARP reply directly to the requester's MAC address containing the target's MAC address, allowing the requesting system to update its ARP cache.
• Broadcast Domains: VLAN architecture defines Layer 2 broadcast domains where ARP operates, with requests that don't cross routers or Layer 3 boundaries.

Understanding these components helps you recognize where ARP spoofing attacks intervene in the resolution process.

How Address Resolution Protocol Works

The resolution process follows a predictable sequence visible in packet captures.

1. Address resolution need and broadcast request: An application needs to communicate with 10.1.1.50 on the local subnet. The system checks the ARP cache first. If no valid entry exists, it broadcasts an ARP request to MAC address FF:FF:FF:FF:FF:FF asking "Who has 10.1.1.50? Tell 10.1.1.25" (the requesting IP address).
2. Targeted response and cache population: The device with IP 10.1.1.50 recognizes its address and sends a unicast ARP reply containing "10.1.1.50 is at MAC address 00:0c:29:3f:47:8a." The requesting system updates its ARP cache with the new IP-to-MAC binding and proceeds with the original communication.
3. Gratuitous ARP: Systems also send unsolicited ARP announcements when interfaces initialize or IP addresses change. Attackers exploit this behavior by sending malicious gratuitous ARP messages to poison caches without waiting for legitimate requests.

Automatic resolution provides operational benefits, but the lack of authentication creates security tradeoffs your team must manage.

Key Benefits of Address Resolution Protocol

ARP handles the address translation IPv4 networks require to route packets between logical IP addresses and physical hardware:

• Automatic address resolution: Administrators never manually map IP addresses to MAC addresses for thousands of devices. ARP handles this translation transparently.
• Dynamic network adaptation: Hardware changes and IP address reassignments trigger ARP to automatically update bindings across the network.
• Routing functionality: Devices use ARP to locate the default gateway's MAC address for all off-subnet traffic.
• Network performance: ARP caching prevents constant broadcasts for every packet, reducing network overhead.

The same properties that make ARP automatic also make it exploitable.

Challenges and Limitations of Address Resolution Protocol

The protocol's design creates security and operational challenges requiring attention. Each vulnerability stems from ARP's fundamental lack of authentication.

Zero Authentication

RFC 826 specifies that devices accept ARP information from any source without validation. This trustless design predates modern threat models involving insider threats and lateral movement. Any device on the local network can claim any IP address, and the protocol provides no mechanism to verify the claim.

Persistent Vulnerabilities in Modern Architectures

IEEE research on software-defined networks confirms ARP vulnerabilities persist even in modern SDN architectures. The fundamental protocol hasn't changed despite decades of security evolution. Virtualized environments, cloud-adjacent networks, and software-defined infrastructure all inherit these same Layer 2 weaknesses.

Broadcast Storm Risks

NIST CVE-2022-27640 documents real-world exploitation where affected devices improperly handle excessive ARP broadcast requests. Attackers exploit this behavior to create denial of service conditions through ARP floods. Network availability degrades as switches struggle to process the flood, potentially masking other malicious activity occurring simultaneously.

Limited Scope of Protection

Firewalls, intrusion prevention systems, and network access controls operate at Layer 3 and above. ARP functions at Layer 2, so these controls cannot prevent ARP spoofing within the same broadcast domain. Attackers who gain access to a single network segment can execute ARP spoofing without triggering perimeter defenses.

Cache Poisoning Attack Surface

Peer-reviewed research on man-in-the-middle attacks shows MitM-ARP spoofing attacks usually target online banking services or other personal online services. Cache poisoning that succeeds despite preventive controls triggers SIEM platforms and behavioral analysis tools to identify subsequent credential theft and lateral movement by analyzing patterns indicating compromise. 

Platforms like SentinelOne identify these post-compromise patterns through behavioral AI that recognizes anomalous authentication, process execution, and file access following successful ARP attacks, enabling autonomous response before attackers achieve their objectives. Even with these detection capabilities, common implementation errors leave networks exposed.

Common Address Resolution Protocol Mistakes

Security teams consistently make implementation errors that render protections ineffective. Understanding these pitfalls helps you avoid them during deployment.

Missing DHCP Snooping Foundation

You enable Dynamic ARP Inspection (DAI) but forget the prerequisite. Enterprise switch vendor configuration guidance specifies that DAI requires DHCP snooping to be enabled globally first. Without the DHCP snooping binding database, DAI cannot validate ARP packets.

Incorrect Trust Boundary Configuration

Misconfigured trust boundaries fail to mark DHCP server connections or uplink ports as trusted. Legitimate DHCP traffic gets blocked, causing network disruption and generating false positives.

Static IP Devices Without Bindings

DAI gets enabled for DHCP-assigned addresses while neglecting the servers, printers, and infrastructure devices using static IPs. Enterprise network switch documentation specifies that DAI requires static IP binding entries for non-DHCP devices. Skipping this step causes legitimate static IP devices to fail DAI validation and lose network connectivity.

Ignoring Log Analysis

DAI runs without anyone monitoring the security event logs. Attacks proceed unnoticed because no one reviews the DAI validation failures and ARP packet drops that indicate active ARP spoofing attempts.

Security teams that feed DAI logs into their SIEM platforms and correlate them with endpoint telemetry from solutions like SentinelOne Singularity gain context connecting Layer 2 attacks to credential misuse and lateral movement. Raw ARP validation failures transform into actionable threat intelligence with autonomous response capabilities.

Avoiding these mistakes requires following standards-based deployment practices in the correct sequence.

Address Resolution Protocol Best Practices

Standards-based protection requires layered security controls implemented in the correct sequence. The following practices address ARP vulnerabilities at the switch level while maintaining network functionality.

Implement Dynamic ARP Inspection Correctly

Enterprise network switch vendor documentation confirms DAI protects switches against ARP spoofing and poisoning attacks by inspecting ARP packets on the LAN and validating them against DHCP snooping database entries. The system validates ARP packets against MAC-IP bindings and drops invalid packets arriving on untrusted ports.

Follow the Required Configuration Sequence

NIST Special Publication 800-215 focuses on secure remote access and SASE frameworks. Official vendor technical documentation from enterprise switch manufacturers recommends configuring DHCP snooping first, including marking server-facing and uplink ports as DHCP-trusted. Then enable DHCP examination per VLAN, create static IP bindings for non-DHCP devices, and enable Dynamic ARP Inspection per VLAN, starting with test segments.

Maintain Static IP Binding Tables

Every server, network appliance, printer, and IoT device using static IP addressing requires a manual binding entry in the DAI configuration. Document these devices during implementation and update bindings whenever infrastructure changes.

Configure Rate Limiting

Set appropriate ARP packet rate limits per interface to prevent denial-of-service attacks exploiting the inspection process. Configure thresholds based on your environment's baseline ARP traffic patterns, following vendor recommendations that may suggest starting points such as 15 packets per second per interface, but should ultimately be tailored to your network.

Segment your Network Architecture

Proper network segmentation ensures attacks in one subnet cannot impact devices in different segments. ARP operates within broadcast domains, so architectural segmentation limits attack propagation and reduces the attack surface per network segment.

Integrate with SIEM for Monitoring

Enterprise switch vendor documentation specifies that DAI logs include source MAC address, VLAN, IP address, and timestamps. Feed these logs to your Security Information and Event Management system for correlation with other security events and pattern analysis indicating coordinated attack campaigns. Security platforms like SentinelOne Singularity correlate ARP-related security events with authentication failures and lateral movement indicators, connecting Layer 2 attacks to business impact.

Deploy Complementary Layer 2 Security

Implement port security to restrict MAC addresses per physical port, configure BPDU Guard to prevent spanning tree attacks, and enable DHCP snooping rate limiting. These controls work together with DAI to create defense in depth at the data link layer.

Preventive controls establish the foundation. Identifying attacks when prevention fails completes the security architecture.

Stop ARP Attacks with SentinelOne

Attackers who bypass Dynamic ARP Inspection or operate on network segments without Layer 2 protections expose a visibility gap. Your security architecture requires correlation between ARP-related anomalies and endpoint behavior. SentinelOne Singularity provides this cross-layer correlation by analyzing network events alongside endpoint telemetry, identifying the credential theft, privilege escalation, and lateral movement that follow successful ARP spoofing attacks.

The Singularity platform addresses the fundamental gap between Layer 2 network controls and Layer 3+ security tools. DAI operates at the switch level to block forged ARP packets, but attackers who succeed in poisoning caches on unprotected segments or during the window before controls deploy require behavioral analysis. Purple AI correlates unusual authentication patterns, suspicious process execution, and anomalous file access with network-layer events. An ARP anomaly logged by your switches connects to actual credential misuse occurring on your endpoints.

Purple AI reduces ARP-related investigation time by automating the correlation of network anomalies with endpoint authentication patterns. Instead of investigating thousands of DAI log entries manually, Purple AI identifies which ARP-related events preceded actual compromise behaviors: Windows authentication using stolen NTLM hashes, PowerShell reconnaissance commands, or unauthorized access to file shares.

The platform's autonomous response capabilities stop lateral movement regardless of the initial attack vector, isolating compromised endpoints, blocking suspicious processes, and preventing data exfiltration before attackers achieve their objectives. For security teams managing hybrid environments with inconsistent Layer 2 control deployment, Singularity identifies the post-compromise behaviors that matter regardless of origin. Alert fatigue drops because the platform prioritizes events with actual business impact.

Request a SentinelOne demo to see how Singularity finds ARP-based lateral movement and stops credential theft with autonomous response.

Key Takeaways

ARP's unauthenticated design won't change. Your defense requires layered controls: DHCP snooping and Dynamic ARP Inspection at the switch level, network segmentation to contain attacks, and behavioral analysis to catch what prevention misses.

Deploy controls in sequence, starting with DHCP snooping before enabling DAI. Feed DAI logs to your SIEM for correlation with endpoint telemetry. Accept that some segments will lack protection, and build detection capabilities accordingly. Protocol vulnerabilities demand architectural security, not protocol fixes.

FAQs

What is the Difference Between ARP Spoofing and ARP Poisoning?

The terms describe the same attack: forged ARP messages overwriting legitimate cache entries. Security literature uses these interchangeably. Both exploit the protocol's lack of authentication to redirect traffic by claiming false IP-to-MAC address bindings. 

Active spoofing generates ARP traffic that DAI can intercept, while passive observation of poisoned caches requires comparing current cache entries against known-good binding databases.

Can ARP Attacks affect Cloud Environments?

ARP operates at Layer 2 within local network broadcast domains, primarily affecting on-premises and private cloud networks. Public cloud virtual networks employ different architectural isolation mechanisms and alternative security approaches. 

However, hybrid environments spanning both on-premises and public cloud architectures require protection strategies aligned with different security models, and attacks in on-premises segments can enable access to cloud resources if proper network segmentation isn't maintained.

How does Dynamic ARP Inspection impact Network Performance?

DAI's performance impact depends on network architecture and traffic patterns. Modern managed switches handle inspection in hardware ASICs with negligible impact. Enable DAI progressively across VLANs, starting with critical segments, while measuring inspection rates and CPU metrics to validate capacity before expanding deployment. 

Monitor baseline ARP traffic during peak hours to establish appropriate rate limits for your environment.

Why don't modern networks use IPv6 to eliminate ARP vulnerabilities?

IPv6 deployment increases in enterprise networks, but most organizations operate dual-stack environments maintaining both IPv4 and IPv6. NIST SP 800-215 recommends that enterprise security architectures consider Layer 2 security controls for IPv4 networks during this extended transition period. Continued ARP protection mechanisms like Dynamic ARP Inspection remain necessary.

How quickly can attackers execute ARP spoofing attacks?

Attackers on the local network can poison ARP caches using readily available tools within seconds of gaining network access. RFC 826 and IEEE research confirm the attack requires no sophisticated exploitation, just the ability to send forged ARP packets on the local broadcast domain. 

The vulnerability in the protocol's trustless design emphasizes why preventive Layer 2 controls are fundamental to ARP security.

What is the Difference Between Static and Dynamic ARP Entries?

Dynamic ARP entries are learned automatically from ARP responses and expire after a timeout period, typically ranging from 2 to 20 minutes, depending on the operating system. Static ARP entries are manually configured by administrators and persist until explicitly removed. 

Static entries prevent ARP cache poisoning for critical infrastructure devices but require manual maintenance when hardware changes or IP addresses are reassigned.