Address Resolution Protocol

Address Resolution Protocol (ARP) is the invisible plumbing of the internet: the mechanism by which a network device discovers the physical hardware address that corresponds to a known logical IP address. It operates below the level of conscious network design, in the gap between the network layer and the data link layer, and its very invisibility is what makes it infrastructural.

ARP is simple in structure and profound in implication. When a device knows the IP address of another device on the same local network but not its MAC address, it broadcasts an ARP request: 'Who has this IP address? Tell me your MAC address.' The target device responds with its MAC address, and the requesting device caches the mapping for future use. The entire transaction takes milliseconds, requires no configuration, and is completely invisible to end users.

ARP as Infrastructural Default

ARP illustrates a principle that runs through every layer of network architecture: the most powerful design decisions are the ones that users never see. ARP was not standardized through a competitive market process. It was defined in RFC 826 in 1982 and has persisted not because it is optimal but because it is the default. Replacing ARP would require coordinating every device on every local network — a transition cost so high that the protocol has survived despite well-known vulnerabilities.

ARP spoofing — the technique by which a malicious device responds to ARP requests with false MAC addresses, redirecting traffic through an attacker's machine — is a direct consequence of ARP's trust model. The protocol assumes that all devices on a local network are honest. This assumption was reasonable in 1982, when local networks were small and administratively controlled. It is catastrophically unreasonable in 2026, when coffee shop Wi-Fi networks routinely contain devices with unknown provenance and malicious intent. Yet ARP persists, because the cost of replacing it exceeds the cost of working around it with additional security layers.

This is the signature of infrastructural entrenchment: a technology survives not because it is good but because the coordination required to displace it is prohibitive. ARP is not unique in this respect. The TCP/IP protocol stack, the Domain Name System, the Border Gateway Protocol — all exhibit the same pattern. They were designed for a smaller, more trusting internet and have accumulated defensive adaptations rather than fundamental redesign.

ARP and the Problem of Invisible Governance

ARP raises a question that is rarely asked in network architecture: who governs the protocols that no one thinks about? The answer, in practice, is no one and everyone. The Internet Engineering Task Force (IETF) maintains the standards, but the IETF has no enforcement power. The actual governance of ARP occurs through the accumulation of deployed devices, router firmware, operating system implementations, and network administrator habits. It is governance by default setting — the path of least resistance for billions of individual decisions.

This is not a flaw. It is a feature of distributed infrastructure. The internet does not have a central architect who can redesign ARP. It has a population of engineers, administrators, and vendors who make locally rational decisions that globally reproduce the existing architecture. The result is a system that is path-dependent, resistant to change, and vulnerable to classes of attack that its designers never anticipated.

ARP is not a protocol. It is a fossil. It survives because the internet is a graveyard of sunk coordination costs, and every layer of the stack is haunted by the ghosts of decisions made in a different era for a different threat model. The question is not whether we can replace ARP. The question is whether we can replace any infrastructural default without the kind of centralized coordination that the internet was designed to resist.