Your router still depends on a 44-year-old protocol to locate every device on your network

Published Aug 24, 2026, 10:00 AM EDT After a 7-year corporate stint, Tanveer found his love for writing and tech too much to resist. An MBA in Marketing and the owner of a PC building business, he writes on PC hardware, technology, and Windows. When not scouring the web for ideas, he can be found building PCs, watching anime, or playing Smash Karts on his RTX 3080 (sigh). Most people are blissfully unaware of what goes on behind the scenes of their home network. As long as their laptop, smartphone, and TV are online, they couldn't care less. One of the many protocols that keep your Ethernet and Wi-Fi functioning is Address Resolution Protocol (ARP), which tells you router which data packet to send to which device. ARP was developed back in 1982, and surprisingly, the majority of home traffic still relies on it. It's basically unchanged since then, helping routers link IP addresses to MAC addresses for almost 44 years. Worryingly, it's fairly easy to exploit, considering security was never baked into it. However, the consequences of ARP spoofing are much lower today than they used to be. Without ARP, your router can't tell one device from another It essentially translates IP addresses to MAC addresses When your router needs to communicate with any device on your home network, it needs to know where to send the respective data packets. Knowing the IP address of said device isn't enough, since that's just the software layer (Layer 3). Routing the traffic to any device requires the physical MAC address, too, which is part of Layer 2. This is where ARP comes in, linking the IP address of every device to its unique MAC address. Your router stores an ARP table for known IP-to-MAC address pairs, making it simpler to talk to every device on the network. IPv6 replaced ARP with Neighbor Discovery Protocol (NDP), but home networks are still heavily IPv4-dependent, making ARP an integral part of people's virtual lives. Without it, your router will probably be lost. It hasn't changed since 1982 Don't change what's not broken Before ARP was developed by David C. Plummer in 1982, network engineers had to hardcode MAC addresses into ARP tables. To solve this tedious problem, ARP automated the IP-to-MAC mapping. It works by enabling every device on the network to broadcast an ARP request, asking which device has a particular IP address. The concerned device sends an ARP reply identifying itself, telling the broadcasting device where to physically send the data. ARP allowed the software layer (IP addresses) to operate independently of the hardware layer. The latter could have evolved in its own way, but it wouldn't have affected the ability of the router to talk to the devices on the network. New devices could join the network and start communicating with the router and other devices instantly, thanks to ARP. ARP has been a part of home networks for almost 44 years, and it remained the only way for devices to locate each other until protocols like NDP came around with IPv6. Today, ARP is still commonplace, which makes it security loopholes a bit concerning. ARP trusts everyone equally, opening the door to security attacks Fortunately, IPv6 is an option ARP has zero built-in authentication, which isn't what you probably expect from a protocol running home networks for over four decades. Any device can simply claim to be something else when replying to an ARP request. Since there's no intrinsic verification involved, ARP spoofing or cache poisoning can give rise to man-in-the-middle MITM attacks. The good thing is that ARP spoofing won't reveal your network traffic, since HTTPS ensures it stays encrypted. That said, older smart home devices like cameras and plugs, which transmit unencrypted data, are still prone to eavesdropping. Using a VPN tunnel will bolster your network security, encrypting even the DNS requests, so attackers won't even know which websites you're visiting. Transitioning to IPv6 replaces ARP with NDP, which enables devices to use cryptographically secure addresses to identify themselves. Moving to IPv6 completely might not be possible for everyone, so ARP will stay around for a while. You could turn on Client Isolation/AP Isolation in your router's setting, which would prevent devices from seeing each other on the network, neutralizing ARP spoofing. However, this can break your smart home, screen sharing, wireless printing, and other local network setups, unless you use guest networks. ARP may be ancient, but it still powers almost all home networks ARP has been powering device discovery on home networks for over four decades. It solved a critical problem back in 1982, and has been part of home networks ever since. Despite some security downsides, it is a major part of modern networking, even years after IPv6 brought NDP as a more secure alternative. It's possible to stay on IPv4 (and ARP) as long as you stick to the necessary security workarounds.