ARP and MAC addresses: how devices find each other on a LAN
How ARP resolves IPv4 addresses to MAC addresses, how switches forward frames and how to diagnose common local network faults.
What you will take away
Knowledge you can put to work.
- Connect ARP, MAC tables and routing in one packet flow
- Distinguish broadcast, unicast and gateway resolution
- Diagnose ARP and Layer-2 faults with tables and captures
ARP maps an IPv4 next hop to a MAC address on the local network. For a remote destination, a host resolves its gateway, not the remote server's MAC; switches separately learn source MAC addresses by VLAN and port.
MAC addresses and the ARP exchange
Ethernet interfaces commonly use 48-bit hexadecimal MAC addresses, for example AA:BB:CC:11:22:33. A manufacturer's address is intended to be unique, but locally administered, virtual or manually changed addresses can differ or be duplicated. In the example 00:1A:2B:3C:4D:5E, the first portion identifies the manufacturer assignment and the remainder the device portion.
A host knowing destination IPv4 address 192.168.1.5 but not its local MAC broadcasts an ARP request to FF:FF:FF:FF:FF:FF. The owner normally replies by unicast with its MAC, illustrated as AA:BB:CC:DD:EE:FF. The sender temporarily caches the association to avoid repeating the broadcast for every frame. The command arp -a displays the local ARP cache; an example cache contains dynamic entries for 192.168.1.1 and 192.168.1.55.
The host resolves the next local hop
For a destination in its own subnet, an IPv4 host resolves that destination's MAC. For a remote subnet, it resolves the default gateway instead. The Ethernet frame reaches the router, which forwards the IP packet and creates a new Layer-2 header for the next segment.
ARP requests remain broadcasts within the local VLAN and replies are usually unicast. The ARP cache stores IP-to-MAC associations. Independently, a switch learns source MAC addresses against VLANs and ports in its CAM or MAC table.
Protect ARP on untrusted segments
ARP has no built-in authentication. An attacker on the same segment can announce false mappings and redirect traffic. Segmentation, admission controls and Dynamic ARP Inspection reduce the risk, but inspection needs correct DHCP-snooping or static bindings.
Static ARP entries scale poorly and are not a general solution. Limit Layer-2 domains, secure switch ports and monitor unexpected mapping changes.
Practical checklist
- 01
Check address, mask and the decision between local destination and gateway.
- 02
Compare the ARP cache before and after a targeted connection test.
- 03
Check the expected device's MAC table entry, VLAN and physical port.
- 04
Capture requests, replies and the MAC addresses actually used.
- 05
Investigate duplicate IPs, port security and anti-spoofing controls.
Frequently asked questions
Why does my PC not know an internet server's MAC address?
MAC addresses apply to the local Layer-2 segment. The PC addresses the frame to its gateway, and each router creates a new Layer-2 header for the following link.
What replaces ARP in IPv6?
IPv6 uses ICMPv6 Neighbor Discovery, including Neighbor Solicitation and Neighbor Advertisement. It performs related tasks but does not use ARP's packet format.
From reading to action
How Bissolux can help
Turn the checks in this guide into a practical plan. Tell us about your systems and requirements so we can agree the work, responsibilities and scope.
Advertisement · BissoluxIT support and operations
Agree a practical approach to troubleshooting, maintenance, responsibilities and recovery.
Advertisement · BissoluxIT infrastructure
Plan network, server and cloud capacity, access and ongoing responsibilities around your actual workloads.