What is ARP?
Address Resolution Protocol
ARP (Address Resolution Protocol) is how an IPv4 device on an Ethernet LAN finds the MAC address that belongs to a given IP address, so it can deliver a frame.
Routing only tells a host the IP address of the next hop. To build an Ethernet frame it also needs that machine's MAC address, and ARP fills the gap. The host broadcasts an ARP request to every device on the LAN (destination ff:ff:ff:ff:ff:ff, EtherType 0x0806) asking, in effect, "who has 192.0.2.1? Tell 192.0.2.10". The owner of that address sends a unicast reply containing its MAC address, and the asker stores the answer in its ARP cache so it doesn't have to ask again for every packet. Entries age out after a while and are re-checked, so a replaced network card or moved address is eventually noticed. A "gratuitous" ARP is an unrequested announcement a device sends about its own address, often used after a failover so that switches and hosts update their tables straight away.
ARP only works within one broadcast domain. For a destination on another subnet, the host doesn't ARP for the destination at all: it ARPs for its default gateway and hands the packet to the router. On Linux the cache is called the neighbour table and is shown with ip neigh; an entry stuck in INCOMPLETE or FAILED means nobody answered, which usually points to a host that is down, unplugged or on a different VLAN than you think. IPv6 doesn't use ARP; it does the same job with NDP. See also MAC addresses and how VRRP uses gratuitous ARP during failover. The Linux Network Connectivity lesson reads the neighbour table on a real lab and shows what failed ARP looks like.
Lessons that use ARP
- Linux Network ConnectivityTeaches this term · Beginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- Switching basics: layer 2, VLANs and IP addressingBeginner · 40 min
How a switch learns MAC addresses and floods broadcasts, how IP subnets and default gateways decide where packets go, how VLANs split a switch into separate networks, and how trunks and a router connect them. Built on a real switch, three PCs and a VyOS router.
- EVPN and VXLAN: layer 2 over a routed fabricAdvanced · 45 min
Stretch a layer-2 segment across a routed leaf-spine fabric: VXLAN for the data plane, BGP EVPN for the control plane. Built with FRR: the underlay, VNIs, type-2 and type-3 routes, route targets, and the VXLAN packets on the wire.
- Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- IPv6 on VyOS: setup and routingBeginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
- IPv4 over an IPv6-only core (RFC 8950)Intermediate · 40 min
Carry IPv4 routes over IPv6 BGP sessions with IPv6 next hops, so core routers need no IPv4 addresses at all. Built on VyOS: the missing router ID, what breaks without the extended next hop capability, native IPv4 on the wire, and why traceroute shows 192.0.0.8.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.