How does ARP resolve IP-to-MAC mappings and what can ARP spoofing enable?

• A. ARP resolves MAC addresses using DNS.
• B. ARP uses ICMP messages to map IPs to MACs.
• C. ARP maps an IP to a MAC by broadcast requests and learned replies; spoofing can redirect traffic to a malicious host.
• D. ARP is used to encrypt traffic.

Answer: (C)

ARP translates IP addresses to MAC addresses on the local network. When a host wants to send a frame to another device on the same LAN, it may not know the destination’s hardware address, so it broadcasts an ARP request asking who has that IP and what their MAC is. Every device on the local network hears the request, but only the device with the matching IP replies with its MAC address. The requester then stores this IP-to-MAC mapping in its ARP cache and uses that MAC for future communications with that IP.

A key detail is that ARP replies don’t have strong authentication. This means a malicious host can send forged ARP replies to trick other devices into associating the attacker’s MAC with a legitimate IP. That ARP spoofing (or poisoning) can redirect traffic to the malicious host, enabling interception, alteration, or even disruption of communications, often in a man-in-the-middle setup. ARP is specific to IPv4 on the local network and operates at the link layer; it isn’t used for DNS name resolution, it isn’t about ICMP, and it doesn’t encrypt traffic.