ARP! Tell your network to explain itself

When sending messages on a local network, two addresses are needed: an IP address and a MAC address. IP addresses identify devices at the network layer, while MAC addresses identify devices at the data link layer. Your network switch doesn't understand IP addresses; it uses MAC addresses to figure out which device a message should go to. When a device wants to send a message, it needs to know the MAC address of the recipient. This is where ARP (Address Resolution Protocol) comes in.

ARP works by asking the network "Who has this IP address?" When a device receives a message asking about its IP address, it responds with its MAC address. The computer then has both the IP and MAC addresses, allowing it to send the message with both addresses in the packet. Computers on the network keep track of known MAC addresses and their corresponding IP addresses in a list called the neighbor table. On Linux, you can view this list with the command "ip neighbour show."

However, ARP can be exploited if an attacker pretends to be another device on the network, a technique known as ARP spoofing. This can cause problems like broadcast storms, where a misbehaving device sends a flood of broadcast messages. It's important to be cautious and responsible when learning about these network concepts.