ARP: L3 or L2?

binarysoul

Given that ARP understands both MAC and IP, do you regard it a L3 or a L2 protocol.

I see it as L3. Am I wrong?

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

sprkymrk

Arp is a layer 2 protocol, you can't really say that arp understands IP. An arp request is a broadcast that says "who has a certain IP, tell this IP", but it's done at layer 2.

Source: 00-0E-A6-0A-B4-5B (my mac)
Destination: ff-ff-ff-ff-ff-ff (broadcast that does not traverse the router, or layer 3 device).

Sorry for the short explanation - but I hope it helped.

Hey, google this:
arp is a layer * protocol

It's about 50/50 for layer 2 and 3.

My vote still says layer 2.

dynamik

I found a pretty good article on Geocities of all places.

It looks like it's L2 because it actually doesn't understand IP. It just maps IPs to MAC addresses. It sends out a broadcast that asks which device has a given IP. Then the device with that IP responds with its MAC address.

[edit]
I just wish I'd get an alert saying, "Someone more knowledgeable than you is already responding." Then I can just brush my teeth and go to bed instead of wasting my time on an OSI-layer scavenger hunt on Google.

KGhaleon

Use a protocol analyzer(packet sniffer, cough) to see how it works in detail. It's layer two.

binarysoul

sprkymrk wrote:

Hey, google this:
arp is a layer * protocol

It's about 50/50 for layer 2 and 3.

Umm, I did that and as per a Cisco book, "Address Resolution Protocol (ARP) is a network layer member of the TCP/IP protocol suite."

http://safari.oreilly.com/0735709955/ch03lev1sec16

But I also found references to L2, so as you said, it's 50/50 L3 and L2.

JDMurray

On the other hand, RARP is definitely Layer 3 because it needs to know about networking protocols to map a Layer 2 address to a Layer 3 address. Layer 3 protocols know about Layer 2 header info, but not visa versa. Also remember the duality of Layer 2, with the MAC sublayer communicating with Layer 1 and the LLC sublayer communicating with Layer 3.

JDMurray

binarysoul wrote:

Umm, I did that and as per a Cisco book, "Address Resolution Protocol (ARP) is a network layer member of the TCP/IP protocol suite."

TCP/IP Layer 2 (Internet) includes OSI Layer 3 (Network).

Internet protocol suite - Wikipedia, the free encyclopedia