Visual Learning · 05 · Live
ARP Resolution
Who-has broadcast → only the owner replies with MAC → cache learns the mapping.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
ARP Resolution
Lab LAN only — never ARP-scan production without authorization.
Real world · Laptops on the same Wi-Fi/VLAN use ARP to map gateway and peer IPs to MAC addresses before any IP packet can leave the NIC.
Attack · A forged ARP reply can poison the cache (see ARP Spoofing & MITM).
Defense · Static ARP for gateways, Dynamic ARP Inspection, and 802.1X reduce poison success.
- Control · DAI / IP–MAC binding on switches where available
- Control · Static ARP for critical gateways
- Control · Alert on duplicate IP / flapping MAC bindings
1. Who-has?
Host A10.1.1.21
SwitchL2 flood
Host B10.1.1.22
Host D10.1.1.24
Who-has?
Host A needs MAC for 10.1.1.24 — sends ARP Who-has to the broadcast domain.
Broadcast
- #1 a → sw Who-has? Broadcast
Space · ← → · R restart