Is ARP a TCP or UDP protocol?
Short answer
Neither. ARP is a Layer-2 (link-layer) protocol that is encapsulated directly in an Ethernet frame, not inside an IP packet. Because it never rides on IP, it cannot use TCP or UDP — those are Layer-4 transports that require IP underneath. ARP's job is to resolve a known IP address to the MAC address on the same local network segment.
The trap here is the false binary. By offering only "TCP or UDP," the interviewer nudges you toward picking one — and the moment you do, you have shown you do not know which layer ARP lives at.
Why neither answer is correct
TCP and UDP are Layer-4 transport protocols. They both require an IP packet (Layer 3) to ride inside. ARP operates below all of that. An ARP message is encapsulated directly in an Ethernet frame (EtherType 0x0806) at Layer 2. There is no IP header involved at all, so there is nothing for TCP or UDP to attach to. Asking whether ARP is TCP or UDP is a category error.
What ARP actually does
ARP — the Address Resolution Protocol — answers a single local question: "Who has IP 192.168.1.10? Tell me your MAC address." It broadcasts the request to the whole segment; the owner replies with its MAC so frames can be addressed on the wire. It only works within a single broadcast domain, which is why it never needs IP routing.
The security angle
ARP has no authentication. Any host can claim any IP, which is the basis of ARP spoofing/poisoning used for man-in-the-middle attacks on a LAN. A strong candidate mentions this without prompting. (In IPv6 the role is filled by NDP, which has the same trust weakness.)
What interviewers look for
The refusal to accept the false binary, plus the Layer-2 explanation. Naming ARP spoofing earns extra credit.
Likely follow-ups
- What layer does ARP operate at and why does that exclude TCP/UDP?
- How does ARP spoofing/poisoning abuse the lack of authentication?
- What is the equivalent of ARP in IPv6?