1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain what a MAC address is and why networks use it.
• Differentiate between MAC addresses and IP addresses.
• Identify unicast, multicast, and broadcast MAC addresses.
• Explain how ARP maps IPv4 addresses to MAC addresses.
• Understand ARP requests, replies, and ARP cache entries.
• Explain Gratuitous ARP and its legitimate uses.
• Understand ARP spoofing and ARP poisoning.
• Recognize signs of suspicious ARP activity.
• Describe practical techniques to protect a local network against ARP-based attacks.

2. What Is a MAC Address?

A MAC (Media Access Control) address is a hardware-level network identifier used to identify a network interface on a local network.

When a device communicates over an Ethernet or Wi-Fi network, its network interface uses a MAC address to identify the local sender and receiver.

A MAC address is generally 48 bits long (6 bytes) and is commonly represented in hexadecimal notation.

Example:

00:1A:2B:3C:4D:5E

Other commonly used formats include:

• 00-1A-2B-3C-4D-5E
• 001A.2B3C.4D5E

Each pair represents one byte.

2.1 Structure of a MAC Address

A traditional 48-bit MAC address contains two main parts:

First 24 bits – OUI (Organizationally Unique Identifier)

Identifies the organization or manufacturer assigned that address block.

Last 24 bits – Interface-specific portion

Used to distinguish interfaces within that assigned address block.

For example:

00:1A:2B : 3C:4D:5E

• 00:1A:2B – OUI portion.
• 3C:4D:5E – Remaining interface identifier.

Important: Modern devices may use randomized or locally administered MAC addresses, especially for Wi-Fi privacy. Therefore, a MAC address does not always reliably identify a device manufacturer or a physical device.

3. MAC Address vs IP Address

Both addresses help devices communicate, but they operate at different networking layers.

Real-world example

Imagine you are sending a parcel:

• IP address = destination street address.
• MAC address = local delivery handoff identifier.
• Router = forwarding point that sends the parcel towards another network.

When your laptop sends data to a server outside your local network, it normally sends the Ethernet frame to the MAC address of its default gateway—not directly to the remote server's MAC address.

The router then forwards the packet towards its next destination.

Key concept: IP addresses help route packets between networks. MAC addresses help deliver frames across a local Layer-2 network.

4. Types of MAC Addresses

There are three important destination-address categories.

4.1 Unicast MAC Address

A unicast frame is intended for one specific network interface.

Example:

00:1A:2B:3C:4D:5E

If Laptop A sends a frame to Laptop B, it can use Laptop B's unicast MAC address as the destination.

4.2 Multicast MAC Address

A multicast frame is intended for a group of interested network interfaces.

Instead of sending separate copies to every device, the network can deliver traffic to members of a particular multicast group.

Multicast is used in services such as streaming, routing protocols, and service discovery.

4.3 Broadcast MAC Address

An Ethernet broadcast frame is intended for all devices on the local broadcast domain.

The standard Ethernet broadcast MAC address is:

FF:FF:FF:FF:FF:FF

ARP requests commonly use this destination because the sender does not yet know which device owns the requested IPv4 address.

Important distinction: A broadcast is generally limited to its Layer-2 broadcast domain. Routers do not normally forward Ethernet broadcasts between networks.

5. What Is ARP?

ARP stands for Address Resolution Protocol.

ARP is used in IPv4 networks to discover the MAC address associated with an IPv4 address on the local network.

A computer may know that it needs to communicate with 192.168.1.20, but it still needs the corresponding local MAC address to construct an Ethernet frame.

ARP helps solve this problem.

5.1 Why Do We Need ARP?

Consider this network:

Laptop A wants to send data to Laptop B.

Laptop A knows Laptop B's IP address, but it does not know its MAC address.

It uses ARP to discover the correct MAC address.

5.2 How ARP Works: Request and Reply

Step 1: ARP request

Laptop A sends a broadcast message:

"Who has 192.168.1.20? Tell 192.168.1.10."

Step 2: Broadcast delivery

The local switch forwards the broadcast frame to the relevant ports in the same broadcast domain.

Step 3: ARP reply

Laptop B recognizes its IP address and responds:

"192.168.1.20 is at BB:BB:BB:BB:BB:BB."

Step 4: ARP cache update

Laptop A stores the IP-to-MAC mapping in its ARP cache.

Step 5: Data transmission

Laptop A can now construct an Ethernet frame addressed to Laptop B's MAC address.

5.3 ARP Request vs ARP Reply

6. What Is an ARP Cache?

An ARP cache is a temporary table maintained by an operating system that stores IP-to-MAC address mappings.

It prevents a device from broadcasting an ARP request every time it communicates with the same local destination.

Example:

ARP entries may be dynamic or static.

• Dynamic entry: Learned automatically through ARP communication and typically expires after a period.
• Static entry: Configured manually and generally remains until changed or removed.

The exact cache behavior depends on the operating system.

6.1 Viewing the ARP Cache

Windows:

arp -a

Linux:

ip neigh show

macOS:

arp -a

These commands let you inspect local neighbor mappings on your own device.

6.2 Clearing or Refreshing Entries

Windows:

arp -d *

Linux:

sudo ip neigh flush all

Use these commands only on your own system. Clearing entries can temporarily interrupt communication while mappings are learned again.

7. What Is Gratuitous ARP?

Gratuitous ARP (GARP) is an ARP message sent by a device to announce or check an IP-to-MAC mapping without first receiving a normal ARP request for that address.

It can serve several legitimate purposes:

1. Announcing a device's IP-to-MAC mapping.
2. Updating neighboring devices after a network interface or MAC address changes.
3. Detecting duplicate IPv4 addresses.
4. Helping high-availability systems update network neighbors after failover.

Example

Imagine a server fails and a backup server takes over the same virtual IP address.

The backup server may send a Gratuitous ARP announcement so that other devices can update their neighbor information to the new MAC address.

Security consideration: Unexpected or repeated ARP announcements can also be a warning sign. GARP itself is not malicious; context and authorization matter.

8. What Is ARP Spoofing?

ARP spoofing, also known as ARP poisoning, is an attack in which an attacker sends deceptive ARP messages to associate an incorrect MAC address with another device's IPv4 address.

The attacker attempts to make other devices believe that the attacker's MAC address belongs to a trusted device, such as the default gateway.

8.1 Normal Network Communication

In a normal network:

• Laptop A knows the gateway IP address.
• Laptop A learns the gateway's genuine MAC address.
• Traffic intended for external networks is sent to the gateway.

8.2 ARP Spoofing Scenario

Suppose:

The attacker sends deceptive ARP information claiming:

192.168.1.1 is at DD:DD:DD:DD:DD:DD

If Laptop A accepts this incorrect mapping, it may send traffic intended for the router to the attacker's device instead.

8.3 Possible Consequences

Depending on the attacker's position and network configuration, ARP spoofing may enable:

• Man-in-the-middle (MITM) positioning.
• Traffic interception.
• Traffic manipulation.
• Connection disruption.
• Session or credential exposure when other security controls are weak.
• Denial of service.

Important: HTTPS and correctly configured encryption can protect application data even when an attacker manages to intercept network traffic. ARP spoofing does not automatically reveal encrypted passwords or break TLS.

9. ARP Poisoning vs Man-in-the-Middle

These terms are related but not identical.

ARP poisoning: Manipulates IP-to-MAC mappings.

Man-in-the-middle: Places an attacker between communicating parties so that traffic may be observed or modified.

ARP poisoning can be one technique used to establish a man-in-the-middle position on a local IPv4 network.

However, not every ARP poisoning incident becomes a successful MITM attack. Network topology, forwarding behavior, encryption, and endpoint protections all matter.

10. How to Detect ARP Spoofing

Security teams can monitor ARP behavior to identify suspicious mapping changes.

Common warning signs

1. The gateway IP address suddenly maps to an unexpected MAC address.
2. Multiple MAC addresses appear to claim the same IP address.
3. Repeated unsolicited ARP replies appear.
4. Unexpected Gratuitous ARP announcements occur.
5. ARP mapping changes happen frequently without an approved network change.
6. Users experience unexplained connection interruptions.

10.1 Example of a Suspicious ARP Table

Previously observed:

192.168.1.1    CC:CC:CC:CC:CC:CC

Later observed:

192.168.1.1    DD:DD:DD:DD:DD:DD

If the gateway hardware has not changed, this deserves investigation.

A changed mapping alone does not prove an attack. DHCP changes, router replacement, high-availability failover, and network reconfiguration can also explain it.

10.2 Packet Analysis

Network administrators can use Wireshark to inspect ARP traffic in an authorized lab or network.

Useful display filter:

arp

To inspect ARP requests:

arp.opcode == 1

To inspect ARP replies:

arp.opcode == 2

Look for:

• Unexpected replies.
• Conflicting IP-to-MAC mappings.
• Repeated announcements.
• Changes to the default gateway mapping.

11. ARP Spoofing Prevention and Protection

ARP does not provide cryptographic authentication of its messages. Networks therefore need additional controls.

11.1 Dynamic ARP Inspection (DAI)

DAI is a switch security feature that validates ARP packets against trusted IP-to-MAC binding information, commonly learned through DHCP snooping.

It can reject invalid ARP messages before they affect other devices.

11.2 DHCP Snooping

DHCP snooping helps a managed switch distinguish trusted DHCP server-facing ports from untrusted client-facing ports.

It builds binding information that other protections, such as DAI, can use.

11.3 Static ARP Entries

Static ARP entries can protect selected critical mappings in small, controlled environments.

However, they are difficult to manage at scale and are not a complete network-wide solution.

11.4 Network Segmentation

Separate employee devices, guest Wi-Fi, servers, management systems, and IoT devices into appropriate network segments.

Segmentation reduces unnecessary communication and limits the impact of local network attacks.

11.5 Switch Port Security

Managed switches may restrict which MAC addresses can be learned on a port.

This helps control unauthorized device connections and certain Layer-2 abuses, although it is not a complete defense against every ARP attack.

11.6 Encryption and Secure Protocols

Use HTTPS, SSH, secure VPNs, and other authenticated encrypted protocols.

These controls reduce the risk of sensitive information being exposed if traffic is intercepted.

11.7 Continuous Monitoring

Monitor:

• ARP table changes.
• Duplicate IP alerts.
• Switch security events.
• DHCP snooping logs.
• Unexpected gateway mapping changes.

Best practice: Combine switch-level protections, network segmentation, endpoint security, encrypted communication, and monitoring. Do not rely on one control alone.

12. Practical Lab 1: Inspect Your Own MAC Address

Objective: Identify the MAC address of your computer's network interface.

Windows:

ipconfig /all

Find the active Wi-Fi or Ethernet adapter and locate:

Physical Address

Linux:

ip link show

macOS:

ifconfig

Find the active network interface and inspect its link-layer address.

Tasks:

1. Identify your active network interface.
2. Record its MAC address.
3. Identify whether the interface is Wi-Fi or Ethernet.
4. Compare its MAC address with the address shown in your operating system's network settings.

Do not publish your personal network details in public screenshots.

13. Practical Lab 2: Inspect Your ARP Cache

Objective: Understand how your computer stores local IP-to-MAC mappings.

Run:

arp -a

Or on Linux:

ip neigh show

Tasks:

1. Identify your default gateway IP address.
2. Find its MAC address in the ARP or neighbor table.
3. Identify other local devices, if visible.
4. Run the command again after communicating with your gateway.
5. Observe whether the table changes.

Expected result: You should understand that your device maintains local neighbor mappings to avoid repeatedly resolving every destination.

14. Practical Lab 3: Observe ARP in Wireshark

Objective: Understand ARP requests and replies through packet inspection.

Environment: Your own computer and an authorized local network or isolated lab.

Steps:

1. Open Wireshark.
2. Select your active network interface.
3. Start a capture.
4. Apply the display filter:

arp

5. Generate normal local network communication, such as communicating with your own gateway.
6. Inspect the ARP request and response.
7. Identify the sender IP, sender MAC, target IP, and target MAC fields.

Expected learning:

• ARP requests commonly use broadcast Ethernet destinations.
• ARP replies provide the requested IP-to-MAC mapping.
• ARP is used for IPv4 neighbor resolution on a local network.

Do not capture other people's private traffic or perform spoofing tests on production networks.

15. Case Study: Why ARP Security Matters

Scenario: Compromised Office Network

An organization has one flat office network containing employee laptops, printers, servers, and guest devices.

An unauthorized device connects to the network.

The attacker attempts to impersonate the default gateway through deceptive ARP messages.

Potential impact:

• Traffic may be redirected.
• Some connections may fail.
• Unencrypted traffic may be exposed.
• Employees may experience connectivity problems.

What should the security team do?

1. Identify the suspicious MAC address and switch port.
2. Verify the legitimate gateway mapping.
3. Review ARP, switch, and DHCP logs.
4. Isolate the unauthorized device using approved incident-response procedures.
5. Enable or review DHCP snooping and Dynamic ARP Inspection where supported.
6. Review network segmentation and endpoint security.
7. Document the incident and monitor for recurrence.

Lesson: Local network trust should never be assumed merely because a device is connected to the office network.

16. Knowledge Check

Q1. What is the primary purpose of a MAC address?

A. Identify a domain name
B. Identify a network interface on a local network
C. Encrypt network traffic
D. Assign an internet connection

Q2. Which OSI layer is associated with MAC addressing?

A. Layer 1
B. Layer 2
C. Layer 3
D. Layer 7

Q3. What is the Ethernet broadcast MAC address?

A. 00:00:00:00:00:00
B. AA:AA:AA:AA:AA:AA
C. FF:FF:FF:FF:FF:FF
D. 11:11:11:11:11:11

Q4. What is the main purpose of ARP?

A. Map IPv4 addresses to MAC addresses
B. Encrypt IP packets
C. Assign IP addresses automatically
D. Resolve domain names

Q5. What does an ARP request usually use as its Ethernet destination?

A. A random MAC address
B. The default gateway's MAC address
C. The broadcast MAC address
D. The DNS server's MAC address

Q6. What is an ARP cache?

A. A list of installed applications
B. A temporary table of IP-to-MAC mappings
C. A DNS database
D. A firewall rule list

Q7. What is Gratuitous ARP commonly used for?

A. Announcing or checking an IP-to-MAC mapping
B. Encrypting Wi-Fi traffic
C. Assigning domain names
D. Blocking all broadcasts

Q8. What is ARP spoofing?

A. Changing a website's DNS record
B. Sending deceptive ARP information to manipulate IP-to-MAC mappings
C. Encrypting a router
D. Updating a DHCP lease

Q9. Which switch security feature can validate ARP messages against trusted bindings?

A. NAT
B. Dynamic ARP Inspection
C. DNS forwarding
D. Port mirroring

Q10. Which command can display the ARP cache on Windows?

A. arp -a
B. ipconfig /release
C. tracert -d
D. nslookup

Answer Key

1. B
2. B
3. C
4. A
5. C
6. B
7. A
8. B
9. B
10. A

17. Lesson Summary

In this lesson, you learned:

• MAC addresses identify network interfaces at Layer 2.
• IP addresses provide logical addressing at Layer 3.
• Unicast, multicast, and broadcast describe different destination delivery types.
• ARP resolves local IPv4 addresses into MAC addresses.
• ARP requests and replies help devices discover local neighbors.
• ARP caches store previously learned mappings.
• Gratuitous ARP can support legitimate announcements and failover.
• ARP spoofing manipulates IP-to-MAC mappings and can support MITM attacks.
• DAI, DHCP snooping, segmentation, encryption, and monitoring help protect networks.

18. Coming Next: ICMP, Ping and Traceroute

In the next lesson, you will learn how devices test connectivity, report network errors, and discover the path that packets take across networks.

Topics include:

• What is ICMP?
• ICMP Echo Request and Echo Reply.
• How ping works.
• How traceroute and tracert work.
• TTL and hop counts.
• Destination unreachable messages.
• Network troubleshooting using ICMP.
• ICMP-related security risks and defensive controls.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice only on systems and networks you own or have explicit authorization to test.