MAC and ARP solve different parts of the same problem
IPv4 applications think in terms of IP addresses, but Ethernet forwards frames using MAC addresses. When a host needs to send an IPv4 packet over Ethernet, it must know which MAC address should receive the frame on the local link. ARP, the Address Resolution Protocol, maps an IPv4 next-hop address to a Layer 2 address.
ARP does not discover the MAC address of every remote Internet destination. It resolves the MAC address of a device on the current Layer 2 segment: either the destination itself if it is local, or the gateway if the destination is remote.
What is a MAC address?
A common Ethernet MAC address is 48 bits long and written in hexadecimal, for example 00:1A:2B:3C:4D:5E. Switches use MAC addresses to decide where to forward frames within a VLAN.
A MAC address is not a replacement for an IP address. IP identifies interfaces and networks in a routable hierarchy. MAC addressing is used for delivery on the local Layer 2 domain.
When does a host need ARP?
Destination 192.168.10.80
Suppose the host is 192.168.10.20/24 and wants to reach 192.168.10.80. The destination is in the same subnet, so the sender needs the MAC address of 192.168.10.80.
Destination 8.8.8.8
The same host sees that 8.8.8.8 is outside its local /24. It therefore sends the packet to its default gateway. ARP resolves the gateway's local IPv4 address, not the MAC address of 8.8.8.8.
ARP Request and ARP Reply step by step
- The sender checks its ARP/neighbor cache for the required IPv4 address.
- If no usable entry exists, it transmits an ARP Request as an Ethernet broadcast.
- Every device in the VLAN receives the broadcast, but the device owning the target IPv4 address recognizes itself.
- The owner sends an ARP Reply containing its MAC address, normally as a unicast response.
- The sender caches the mapping and can now build the Ethernet frame.
The exact cache lifetime and state machine depend on the operating system, but the purpose is the same: avoid broadcasting a request for every packet.
What information does an ARP message contain?
ARP messages include the hardware type, protocol type, hardware and protocol address lengths, operation code, sender hardware address, sender protocol address, target hardware address, and target protocol address. On Ethernet/IPv4 this means MAC and IPv4 information for the sender and target.
The ARP request asks, in effect: Who has this IPv4 address? Tell this sender. The reply provides the mapping.
The ARP cache or neighbor table
Operating systems maintain a table of recently learned Layer 3-to-Layer 2 mappings. Depending on the platform, entries can be dynamic, static, reachable, stale, incomplete, or in another state. Commands such as arp -a or ip neigh let you inspect this information.
A stale or incorrect mapping can cause traffic to be sent to the wrong local interface until the entry is refreshed. Clearing a neighbor entry can therefore be useful during troubleshooting, but it should not be the first response to every connectivity problem.
Gratuitous ARP and Proxy ARP
Gratuitous ARP announces or probes an address without first receiving a normal request. It can help update neighbors after failover, detect duplicate use, or announce a new MAC/IP association.
Proxy ARP allows a device, often a router, to answer ARP on behalf of another destination. It can make remote destinations appear locally reachable at Layer 2, but it can also hide addressing-design problems, so it should be used deliberately.
ARP spoofing and why ARP needs protection
Classic ARP has no built-in authentication. A malicious or misconfigured host can send false mappings and attempt to redirect traffic. This is commonly called ARP spoofing or ARP poisoning.
Managed switching environments can reduce the risk with segmentation, DHCP snooping, Dynamic ARP Inspection, port security, and other Layer 2 controls. Encryption at higher layers protects data even if local traffic is intercepted.
ARP is not the switch MAC address table
These two tables are often confused. A host or router's ARP/neighbor table maps IPv4 address → MAC address. A switch MAC table maps MAC address → switch port/VLAN. ARP is a Layer 3-to-Layer 2 resolution process; MAC learning is a switching process.
When a host sends an ARP Request, the switch does not answer simply because it knows a MAC. It forwards the broadcast within the VLAN while learning the source MAC from the incoming frame.
IPv6 does not use ARP
IPv6 uses Neighbor Discovery, carried in ICMPv6, for neighbor resolution and several additional functions. Neighbor Solicitation and Neighbor Advertisement messages replace the basic ARP resolution role, while ICMPv6 also supports router discovery and other essential IPv6 behavior.
That is why indiscriminately blocking ICMPv6 can break IPv6 in ways that blocking some IPv4 ICMP messages does not.
Complete example: sending traffic to the Internet
A laptop at 192.168.1.50/24 wants to reach a public web server. It compares the destination with its own subnet and decides the server is remote. It looks for the default gateway, for example 192.168.1.1, in its ARP cache. If necessary, it broadcasts an ARP Request and learns the gateway's MAC address.
The laptop then sends an Ethernet frame to the gateway MAC while keeping the web server's IP as the packet destination. The router removes the frame, routes the IP packet, and builds another Layer 2 frame for the next hop. ARP solved only the local-neighbor step.
What to study after MAC and ARP
Continue with network devices to connect ARP with switches and routers, then study IP addressing, IPv6 Neighbor Discovery, VLANs, and routing.