https://kostandyan.xyz/tags/arp/Recent content in Arp on Tigran KostandyanHugoen-usTue, 05 May 2026 00:00:00 +0000https://kostandyan.xyz/series/networking/arp/Tue, 05 May 2026 00:00:00 +0000https://kostandyan.xyz/series/networking/arp/<h2 id="arp">ARP</h2> <p>Welcome to the second post in the series. Last time we built the link layer – capturing raw Ethernet frames over BPF on macOS. This time we&rsquo;re going one notch up the stack: <a href="https://en.wikipedia.org/wiki/Address_Resolution_Protocol">ARP</a>, the Address Resolution Protocol. It&rsquo;s how a host figures out which MAC address corresponds to a given IPv4 address on the local network, so Ethernet frames know where to actually go.</p> <p>But before we get to ARP itself, we need to revisit the link layer. The version we ended Part 1 with was fine for reading and printing frames, but it has a handful of problems that show up as soon as we try to do anything more serious – like sending frames back, processing more than one packet per syscall, or letting upper layers (ARP, IP, TCP) compare ethertypes without parsing strings.</p>