Learn
LoginRegister
FundamentalsBeginnerFree lab

Fundamentals · browser room

ARP Resolution

Beginner65 ptsARPL2

Objective

Host A broadcasts Who-has IP? — only the owner replies with MAC; others ignore.

Cyber Flow Explorer · 4 steps · Network / Sequence / Packet / Code.

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

CYNARKS

Teaching simulation · not live capture

ARP Resolution

Lab LAN only — never ARP-scan production without authorization.

Real world · Laptops on the same Wi-Fi/VLAN use ARP to map gateway and peer IPs to MAC addresses before any IP packet can leave the NIC.

Attack · A forged ARP reply can poison the cache (see ARP Spoofing & MITM).

Defense · Static ARP for gateways, Dynamic ARP Inspection, and 802.1X reduce poison success.

  • Control · DAI / IP–MAC binding on switches where available
  • Control · Static ARP for critical gateways
  • Control · Alert on duplicate IP / flapping MAC bindings

1. Who-has?

Host A10.1.1.21
SwitchL2 flood
Host B10.1.1.22
Host D10.1.1.24
Who-has?
Host A needs MAC for 10.1.1.24 — sends ARP Who-has to the broadcast domain.

Broadcast

  • #1 a → sw Who-has? Broadcast

Space · ← → · R restart

Hint

Matching IP → reply; others ignore.

Why this is correct

Legitimate ARP maps IP to MAC; only the owner replies.