ARP, ND, and Local Resolution

Updated

September 4, 2026

ARP, ND, and Local Resolution

On multi-access links, IP needs a local next-hop mapping: IPv4 uses ARP; IPv6 uses Neighbor Discovery (ND). If resolution fails, routing never gets a chance.

Learning goals

  • Explain when ARP/ND runs (on-link destinations and gateways)
  • Read and clear neighbor tables on Linux
  • Spot incomplete entries and wrong-subnet mistakes
  • Capture ARP or NS/NA in a lab

When local resolution happens

  1. Host decides destination is on-link (connected route), or
  2. Host needs the gateway’s MAC for an off-link destination

Then: resolve next-hop IP → MAC; build Ethernet header; send.

ARP (IPv4)

Message Role
Who-has (request) Broadcast: “Who has IP X? Tell Y”
Is-at (reply) Unicast: “X is at MAC M” 
ip neigh show
ip neigh show dev eth1
ping -c1 192.168.10.1
ip neigh show
# force re-resolve
ip neigh flush dev eth1

Incomplete / failed ARP

Cause What you see
Target down Incomplete, then failed
Wrong VLAN / segment No reply
Wrong mask (thinking on-link when not) ARP for remote IPs on LAN
Firewall drop Silence

Neighbor Discovery (IPv6)

Message (ICMPv6) Role
Neighbor Solicitation Resolve or probe neighbor
Neighbor Advertisement Provide or confirm MAC
Router Solicitation / Advertisement Find routers; SLAAC info 
ip -6 neigh show
ping -6 2001:db8:1::1

Gratuitous ARP and updates

Hosts may announce their own IP/MAC (gratuitous ARP) on address change. Useful for failover designs later (first-hop redundancy).

Proxy ARP (awareness)

A router answering ARP for non-local addresses can hide topology mistakes—or create blackholes. Prefer correct masks and routes over proxy ARP as a habit.

Lab sketch

  1. Two hosts + gateway on /24
  2. tcpdump -ni eth1 arp while first ping runs
  3. Wrong mask on host: watch ARP for remote destinations

Checkpoint

Host 10.0.0.10/24, gateway 10.0.0.1. Destination 10.0.1.10. Which IP is ARP’d for? Why?

Next