How do I view my ARP table?

To view your ARP table, open your command-line interface and type “arp -a”. This will display the mapping of IP addresses to physical MAC addresses for devices on your local network.

What is ARP poisoning/ARP spoofing and how does it work?

ARP poisoning or ARP spoofing is a cyberattack where forged ARP messages are sent over a local area network (LAN). Because ARPs lack built-in authentication mechanisms, they aren’t able to verify the source of ARP messages. There are a few strategies you can use to protect yourself from ARP spoofing: You can start by configuring DHCP snooping, which acts as a firewall between untrusted hosts and DHCP servers. This will allow you to enable dynamic ARP inspection (DAI), configuring switch-to-switch ports as trusted. When activated, DAI treats all ports as untrusted. You can also manually configure static ARP entries, which are permanent mappings between and IP address and a MAC address in a device’s ARP table. Static ARP entries prevent automatic dynamic updates, and force a fixed, trusted association by locking a specific IP address to a unique MAC address in a device’s ARP cache, which prevents it from being updated by dynamic ARP traffic. Network segmentation may also be helpful. It breaks Layer 2 broadcast domains into smaller, isolated VLANs. By limiting network broadcast domains, attackers can only spoof devices within their specific segment, which can reduce the impact of attacks.

What is an ARP Table?

An ARP table is a storage repository (cache) for all the mapping information of the different MAC and IP addresses.

What does the Address Resolution Protocol do?

ARP enables communication between devices on a local area network by connecting a computer's IP address to its MAC (media access control) address, allowing data to transfer between software and devices within the network.

How does ARP work with an example?

When data arrives at a gateway, ARP searches the ARP cache for matching IP and MAC addresses. If a match is found, data travels to the correct device; if not, an ARP request is initiated to establish communication and add the new address pairing to the ARP cache table.

What Is Address Resolution Protocol?

Written by Coursera Staff • Updated on Jul 20, 2026

Learn about the address resolution protocol and how it connects a computer's IP address to a MAC address within a local area network.

[Featured Image] Two employees discuss Address Resolution Protocol in the office.

Key takeaways

The address resolution protocol (ARP) enables communication between an internet protocol (IP) address and media access control (MAC) address.

Four types of ARP are proxy ARP, gratuitous ARP, reverse ARP, and inverse ARP.

If a device is unable to find the matching IP and MAC addresses in the ARP cache, an ARP request is initiated, allowing devices to establish communication with one another.

You can locate all of the mapping information for the different MAC and IP addresses in the ARP table, which functions as a storage repository.

Learn more details about ARP, including how it works and its different types. If you're ready to build job-ready skills that can help you qualify to work with networks, consider enrolling in the Google IT Professional Certificate. You'll have the opportunity to learn to perform day-to-day IT support tasks, including computer assembly, wireless networking, installing programs, and customer service, as well as how to use systems, including Linux, domain name systems, command-line interface, and binary code.

What is address resolution protocol?

By facilitating the connection between the internet protocol (IP) address and media access control (MAC) address, the address resolution protocol (ARP) enables communication between devices connected to a local area network. This allows for the transfer of data back and forth between software and the devices within a network. The MAC address is also known as the physical address of the device or machine.

How does address resolution protocol work?

When transferring data from devices through the network and to a host machine, the data first arrives at a gateway that supports the flow of data throughout different networks. From there, the gateway relies on the ARP to find a matching IP and MAC address. This information exists within the ARP cache or ARP cache table.

After confirming the matching addresses, the data is free to travel through the network to the correct device. However, if a device is unable to find the matching IP and MAC addresses in the ARP cache, then an ARP request is initiated. An ARP request allows devices to establish communication with one another, resulting in a new addition to the ARP cache table.

Due to the small size of the ARP cache, removing addresses from the cache often occurs to ensure ample space for new addresses, as well as help mitigate the risk of cyber attackers who could attempt to steal IP addresses.

The ARP Process:

1. Check the Cache: The system looks at its ARP table to see if it already knows the MAC address for the destination IP.

2. Initiate Request: If the address is not found, an ARP Request is broadcast to every device on the local network.

3. Receive Response: The device with the matching IP sends back an ARP Reply containing its MAC address.

4. Update Table: The original device saves this mapping in its ARP table for future use.

Note: Because ARP caches are small, addresses are periodically removed (flushed) to save space and mitigate "ARP Spoofing" security risks.

Types of ARP (address resolution protocols)

Here are the four different types of address resolution protocols and the details that make each unique:

Proxy ARP: During a proxy ARP, a proxy device responds to the request for the IP address of a device that doesn’t belong to the local area network. Rather than sending the MAC address of the targeted device, the proxy device shares its own MAC address instead.

Gratuitous ARP: Instead of responding to an ARP request, a gratuitous ARP response occurs to help host devices update the ARP cache with IP and MAC addresses found throughout the entire network.

Reverse ARP: In cases where systems or networks don’t have the memory to store their own IP address, reverse ARP sends an IP address instead of a MAC address, allowing the system to discover its IP address and enabling it to communicate within the network.

Inverse ARP: A traditional access protocol uses an IP address to locate a MAC address. However, an inverse ARP performs oppositely, translating MAC addresses to IP addresses.

What is an address resolution protocol table?

An ARP table is the storage repository for all of the mapping information of the different MAC and IP addresses.

Related terms

MAC address: The physical ID of your network hardware
TCP/IP: The primary suite of communication protocols used for the internet
IPv6: The latest version of the Internet Protocol, which uses NDP (Neighbor Discovery Protocol) instead of ARP
DHCP: Automatically assigns IP addresses to devices on a network

Keep up with trends and job opportunities in IT

To stay current regarding trends and job opportunities in IT, join Career Chat on LinkedIn. You can also check out these free resources:

Watch on YouTube: Exploring IT Career Paths: Your Guide to a Rewarding Tech Future

Discover more: How AI is transforming IT

Learn the terminology: Information Technology (IT) Terms: A to Z Glossary

Accelerate your career growth with a Coursera Plus subscription. When you enroll in either the monthly or annual option, you’ll get access to over 10,000 courses.

Build job-ready skills with Coursera Plus

Start 7-day free trial

Frequently Asked Questions (FAQs)

ARP poisoning or ARP spoofing is a cyberattack where forged ARP messages are sent over a local area network (LAN). Because ARPs lack built-in authentication mechanisms, they aren’t able to verify the source of ARP messages. There are a few strategies you can use to protect yourself from ARP spoofing:

You can start by configuring DHCP snooping, which acts as a firewall between untrusted hosts and DHCP servers. This will allow you to enable dynamic ARP inspection (DAI), configuring switch-to-switch ports as trusted. When activated, DAI treats all ports as untrusted.
You can also manually configure static ARP entries, which are permanent mappings between and IP address and a MAC address in a device’s ARP table. Static ARP entries prevent automatic dynamic updates, and force a fixed, trusted association by locking a specific IP address to a unique MAC address in a device’s ARP cache, which prevents it from being updated by dynamic ARP traffic.
Network segmentation may also be helpful. It breaks Layer 2 broadcast domains into smaller, isolated VLANs. By limiting network broadcast domains, attackers can only spoof devices within their specific segment, which can reduce the impact of attacks. ‎

Updated on Jul 20, 2026

Written by:

Coursera Staff

Editorial Team

Coursera’s editorial team is comprised of highly experienced professional editors, writers, and fact...

This content has been made available for informational purposes only. Learners are advised to conduct additional research to ensure that courses and other credentials pursued meet their personal, professional, and financial goals.