ARP: How a Local Network Finds the Next Interface

Week 16 separated IP addresses from MAC addresses.

Now connect them.

On a local IPv4 network, ARP, the Address Resolution Protocol, helps a device learn which local link-layer address corresponds to an IPv4 address it needs to reach.

Conceptually:

"Who has this local IPv4 address? Tell me your interface address."

The local-delivery problem

The GSC synthetic capture uses this workstation:

IPv4: 192.0.2.25
MAC:  02:00:00:00:00:25

and this local server:

IPv4: 192.0.2.10
MAC:  02:00:00:00:00:10

The workstation knows the server's IP address, but local Ethernet delivery still needs the appropriate destination MAC address.

ARP supplies that mapping.

The important boundary is local delivery. ARP does not discover the MAC address of every remote server on the Internet. It resolves the local destination or next hop the frame needs to reach first.

Request and reply

The first two packets in the Week 17 capture represent this exchange:

ARP Request:
Who has 192.0.2.10?
Tell 192.0.2.25.

The server answers:

ARP Reply:
192.0.2.10 is at 02:00:00:00:00:10

The workstation can then use that mapping for local delivery.

Do not memorize those values as generic ARP behavior. They belong to this synthetic GSC dataset.

Inspect the same idea from the host side

The bounded terminal below exposes a simulated interface address, route, neighbor table, gateway ping, TCP connection, and teacher-provided packet notes. No live packets are sent.

Garden State Cyber network evidence simulation
All addresses use classroom/documentation values and no packets leave the lesson.
Type 'help' for the bounded command list.

$ ip addr
2: eth0: <UP> mtu 1500
    link/ether 02:42:ac:11:00:25
    inet 192.168.10.25/24

$ ip route
default via 192.168.10.1 dev eth0
192.168.10.0/24 dev eth0 scope link src 192.168.10.25

$ ip neigh
192.168.10.1 dev eth0 lladdr 02:42:ac:11:00:01 REACHABLE

$ ping -c 2 192.168.10.1
64 bytes from 192.168.10.1: icmp_seq=1 ttl=64 time=0.7 ms
64 bytes from 192.168.10.1: icmp_seq=2 ttl=64 time=0.8 ms
2 packets transmitted, 2 received, 0% packet loss

$ ss -tn
State  Recv-Q Send-Q Local Address:Port    Peer Address:Port
ESTAB  0      0      192.168.10.25:51514  203.0.113.10:443

$ cat packet-notes.txt
Packet 12: ARP request  Who has 192.168.10.1? Tell 192.168.10.25
Packet 13: ARP reply    192.168.10.1 is at 02:42:ac:11:00:01
Packet 20: TCP          192.168.10.25:51514 -> 203.0.113.10:443 [SYN]
Packet 21: TCP          203.0.113.10:443 -> 192.168.10.25:51514 [SYN, ACK]
Packet 22: TCP          192.168.10.25:51514 -> 203.0.113.10:443 [ACK]

Compare:

ip addr
ip route
ip neigh

Those commands answer different questions:

• ip addr: what addresses does this interface have?
• ip route: where should IP traffic go?
• ip neigh: which local IP-to-link-address mappings are known?

ARP is local

If the destination is on another network, the workstation usually does not ARP for the remote server's MAC address.

It needs the MAC address of the local next hop, commonly the router.

That reinforces the distinction:

• IP addresses support routed addressing
• ARP resolves a local IPv4 destination or next-hop mapping
• Ethernet uses the resulting local link-layer destination

Read a synthetic neighbor table

Teacher-provided example:

Identify:

• likely local router entry
• local server entry
• printer entry from the supplied network diagram

Do not assume a MAC address identifies a person.

Read a provided ARP record

The actual Week 17 synthetic packet begins with this evidence:

Sender IP: 192.0.2.25
Sender MAC: 02:00:00:00:00:25
Target IP: 192.0.2.10
Operation: request

What does that support?

It supports the claim that the synthetic workstation requested a local mapping for 192.0.2.10.

What does it not prove?

• an attack
• compromise
• user identity
• intent

ARP traffic is normal IPv4 local-network behavior.

Build the ARP sequence diagram

Draw:

workstation -> local broadcast request -> server reply -> workstation mapping -> local frame delivery

Then draw a second conceptual case where the destination is on another network:

workstation -> ARP for local router -> router forwards the IP packet toward the remote network

Keep the two cases separate.

Evidence for Lesson 1

Submit:

• ARP mapping explanation
• synthetic neighbor-table interpretation
• local request/reply diagram
• remote-destination next-hop diagram
• one paragraph explaining why observing ARP traffic does not by itself indicate an attack

Finish with:

ARP connects the IP layer to local delivery by ________.

Packet analysis becomes much easier when you can explain why a packet exists before deciding whether it is suspicious.