skip to content

ARP resolves IPv4 addresses to MAC addresses; is ARP an OSI layer 2 or layer 3 protocol, and how do you justify your answer?

level: middleimportance: should knowfreq 46%

answer

  1. what encloses an ARP message
  2. whose addresses sit in its payload
  3. does a router forward it
  4. IPv6 moved the job elsewhere

basics

~20 s

ARP is usually placed at layer 2: its messages travel directly in link-layer frames with no IP header and never cross a router. It serves layer 3 by carrying IPv4 addresses, which is why some textbooks call it layer 2.5.

solid answer

~40 s

I place ARP at **layer 2**, with a reason for the disagreement. An ARP message sits directly inside a link-layer frame, identified by its own EtherType, with **no IP header**; its requests are broadcast on one link and a router does not forward them. RFC 1122 accordingly covers ARP in its **link layer** chapter (§2.3.2). But in practice ARP exists to serve IPv4: its payload carries IPv4 addresses, and its job is to find the MAC address for a next-hop IP address. That is why some sources say layer 3 or "layer 2.5". The useful point is that the carrier and scope are layer 2 while the purpose is layer 3. IPv6 shows the choice is about mechanism: **Neighbor Discovery** does the same job with messages carried inside IPv6 packets.

go deeper

for a junior

Remember that ARP maps IPv4 addresses to MAC addresses on the local link and is usually placed at layer 2. Be ready to say it is not forwarded by routers.

for a middle

Argue the placement from evidence: carried directly in a frame with no IP header, confined to one link, yet carrying layer 3 addresses. Name the layer 2.5 convention and why it exists.

for a senior

Use the IPv6 contrast: Neighbor Discovery does the same job inside IPv6, so placement follows mechanism. Connect that to why a host resolves its gateway rather than a remote server.

for a principal

Treat helper protocols as proof that layering is a convention. Show you can pick a defensible answer quickly and move the conversation to what the placement changes in practice.

## What ARP is for The **Address Resolution Protocol (ARP)** answers one question for an IPv4 host: "I have to send this datagram to next-hop address X on my link; which MAC address should the frame go to?" The request/reply exchange and the ARP cache belong to the Ethernet material; the placement question only needs what ARP carries and what carries it. The difficulty is that ARP touches two layers at once. Its **purpose** is layer 3: in practice it exists because IPv4 needs to reach a neighbour. Its **transport** is layer 2: it never leaves the link it was sent on. ## The case for layer 2 - **No IP header.** An ARP message is placed directly in the payload of a link-layer frame, marked by its own EtherType. There is no IP header around it, so there is no IP source, destination or TTL. - **One link only.** An ARP request is sent as a link-layer broadcast. Routers do not forward link-layer broadcasts, so an ARP request from one subnet never reaches hosts on another. - **The RFCs file it there.** RFC 1122 discusses ARP in chapter 2, "Link Layer" (§2.3.2), next to Ethernet encapsulation (§2.3.3) and the link/internet layer interface (§2.4). - **Nothing above it is involved.** No transport protocol and no port is part of an ARP exchange. ## The case for layer 3 - **Its payload is layer 3 data.** An ARP message carries the sender's and target's IPv4 addresses alongside their hardware addresses. - **It exists to serve a network layer.** Without a network-layer protocol, in practice IPv4, that needs next-hop resolution, ARP has no reason to run. - **Its format names a protocol type.** ARP was written generically, with fields for the hardware type and the protocol type being resolved, which reads as a network-layer helper. This split is where the label **"layer 2.5"** comes from. It is a textbook convention, not a layer in either model. ## The same job in IPv6 IPv6 has no ARP. **Neighbor Discovery** (RFC 4861) does address resolution with Neighbor Solicitation messages sent to a "solicited-node multicast address" computed from the IPv6 address being resolved. Those messages are ICMPv6 messages carried inside IPv6 packets, so in IPv6 the resolution job moved to layer 3. | | ARP (IPv4) | Neighbor Discovery (IPv6) | |---|---|---| | What encloses it | a link-layer frame directly | an IPv6 packet | | IP header present | no | yes | | How it reaches neighbours | link-layer broadcast | IPv6 multicast | | Usual placement | layer 2 (or "2.5") | layer 3, with ICMPv6 | The job did not change between the two; the mechanism did, and the placement followed the mechanism. That is the strongest argument that ARP's layer is decided by how it travels. ## The RFCs are not strict about this either RFC 1122's own overview lists **RARP**, ARP's reverse-direction relative, among the application layer "support protocols", next to DNS and BOOTP, even though RARP travels in link-layer frames the way ARP does. The authors were grouping protocols by what they help with (booting, name mapping), not by where their headers sit. Treat placement as a reasoned convention, and expect sources to disagree on helper protocols. ## What the placement means when something breaks Placing ARP at layer 2 is not just labelling; it tells you where its failures live. - **Failures are local.** A stale or wrong ARP cache entry breaks delivery to one neighbour on one link, often the default gateway, while the IP configuration looks correct. - **Remote traffic depends on one local answer.** Every datagram to another subnet is framed for a gateway's MAC address, so a failed resolution for the default gateway cuts off everything reached through it. - **Nothing is routed.** Since ARP never crosses a router, its problems are diagnosed on the link where the sender sits, not along the path. ## How to answer 1. Pick a layer: layer 2 is the most common answer and the easiest to defend. 2. Give the carrier evidence: in a frame, no IP header, not forwarded by routers. 3. Give the purpose counter-argument: carries IPv4 addresses, exists to serve IP. 4. Close with IPv6 Neighbor Discovery to show that placement follows mechanism.

  • Why can a host not ARP for a server on another subnet, and what does it do instead?
    ARP requests are link-layer broadcasts and routers do not forward them, so they never reach another subnet. The host sends the datagram to its default gateway, so it ARPs for the gateway's IPv4 address and puts the gateway's MAC address in the frame while the IP destination stays the remote server.
  • Does IPv6 Neighbor Discovery settle the ARP placement debate?
    It supports the mechanism-first view. The resolution job is identical, but Neighbor Discovery travels inside IPv6 packets as ICMPv6 messages, so it sits at layer 3 while ARP, travelling directly in frames, sits at layer 2. Same purpose, different carrier, different layer.

saying these in an interview costs you the question

  • ARP is layer 3 because ARP messages travel inside IP packets.
  • An ARP request is routed to the subnet where the target lives.
  • IPv6 still uses ARP, just with longer address fields.
  • ARP has a TTL that limits how many hops it can travel.
  • Layer 2.5 is an official layer defined by the OSI model.