Which OSI layer does ARP belong to?
Show the answer
Say this first
ARP is carried directly inside an Ethernet frame with EtherType 0x0806, with no IP header, so by
encapsulation it is layer 2. Its job is to map a layer 3 address (IPv4) to a layer 2 address (MAC), so it
serves layer 3. I say it sits between the two, which is why people call it "layer 2.5". The answer the
interviewer wants is that reasoning, not a single number.
Go deeper
The evidence for each side
- Layer 2 argument. ARP messages are never routed. They have no TTL and no IP header. A router does not forward an ARP request to another network.
- Layer 3 argument. ARP exists only because IP needs a MAC to build a frame. Its fields carry IPv4 addresses, and the ARP cache is consulted by the IP stack.
The ARP packet (IPv4 over Ethernet)
| Field | Value |
|---|---|
| Hardware type | 1 (Ethernet) |
| Protocol type | 0x0800 (IPv4) |
| Hardware and protocol address lengths | 6 and 4 |
| Opcode | 1 request, 2 reply |
| Sender MAC, sender IP, target MAC, target IP | 28 bytes total |
The 28-byte ARP payload is padded to the 46-byte Ethernet minimum.
They will ask next
What replaces ARP in IPv6?
Neighbor Discovery (NDP), which uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages sent to solicited-node multicast addresses instead of broadcast. Because it rides on IPv6, NDP is clearly a layer 3 protocol.
Where would you place DHCP and ICMP by the same logic?
ICMP is carried inside IP (protocol 1) and serves IP, so layer 3. DHCP rides on UDP ports 67 and 68, so it is an application protocol that configures layer 3.
Traps
- Saying "layer 3" flatly. ARP has no IP header and is never routed.