What does ARP stand for?
ARP stands for Address Resolution Protocol. The protocol that finds the MAC address belonging to a known IPv4 address on the local network, caching the answer in the ARP table (arp -a). ARP has no authentication, so attackers can spoof replies to intercept traffic; dynamic ARP inspection on switches counters this.
ARP finds the MAC address that belongs to an IPv4 address on the local network. Before a device can send a frame to a neighbour or to its gateway, it broadcasts the question: who has this IP address? The owner replies with its MAC address, and the answer is kept in the ARP cache for a while. ARP has no authentication, so a device can send false replies and make others send it their traffic. That attack is called ARP spoofing or ARP poisoning. IPv6 does not use ARP; it uses Neighbor Discovery.
ARP in practice: an example
On an open office network, an attacker's laptop keeps telling the other PCs that the gateway's IP address belongs to the laptop's MAC address. The PCs update their caches and send their internet traffic to the laptop, which forwards it and reads it on the way. A switch with dynamic ARP inspection would have dropped the false replies.
What ARP is confused with
ARP vs DNS: what is the difference?
DNS turns a name into an IP address, anywhere on the internet. ARP turns an IP address into a MAC address, only on the local network segment. What DNS stands for
ARP vs MAC address table: what is the difference?
The ARP cache is kept by hosts and routers and maps IP addresses to MAC addresses. The MAC address table is kept by a switch and maps MAC addresses to switch ports.
Which exams cover ARP?
ARP is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 4.0 (Network Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A PC knows the IP address of its default gateway but not its hardware address. What does it send?
- An ARP request broadcast
- A DNS query
- A DHCP release
- An ICMP redirect
Show the answer
A. An ARP request broadcast. ARP resolves an IPv4 address to a MAC address on the local segment, and the request is broadcast so that the owner can answer.
2. An attacker sends forged ARP replies so that traffic for the gateway is delivered to the attacker's machine. What kind of attack does this enable?
- An on-path attack
- A brute-force attack
- Shoulder surfing
- A birthday attack
Show the answer
A. An on-path attack. By poisoning ARP caches the attacker places a machine in the path between the victims and the gateway and can read or change the traffic.
Sources: RFC 826: An Ethernet Address Resolution Protocol; MITRE ATT&CK: Adversary-in-the-Middle, ARP Cache Poisoning (T1557.002); Microsoft Learn: arp command. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.