ARP: finding a MAC from an IP

Knows the IP, needs the MAC

Your computer addresses packets with IP addresses. But on the local network, frames are delivered by MAC address: the switch forwards a frame by its destination MAC, and a network card only picks up frames meant for its own MAC (or for everyone).

So before your computer can send anything to a neighbor, it has to fill in the destination MAC. Usually it only knows the IP. ARP is the protocol that connects the two.

The ARP request: a shout to everyone

Your computer sends an ARP request as a broadcast: a frame addressed to ff:ff:ff:ff:ff:ff, which the switch floods out of every port in the subnet (the VLAN). The message is simple: "Who has 192.168.1.1? Tell me your MAC."

Every device on the subnet hears the request. The printer, the other laptops and the phone all read it, see that the IP isn't theirs, and ignore it.

The ARP reply: only the owner answers

The one device that owns that IP sends back an ARP reply: "That's me, here's my MAC." The reply is normally unicast, straight back to the computer that asked, not to everyone.

Why ask for 192.168.1.1, the router? Because for anything on another network, like a website, your computer delivers the frame to its default gateway (see EP24). So the MAC it needs is the router's, while the IP destination stays the far-away server.

The ARP cache

Your computer saves the answer in its ARP cache, a small table of IP → MAC pairs. Next time, it looks there first and sends the frame straight out, no shouting. Entries expire after a while, so the table stays fresh if a device changes. How long depends on the system: Cisco IOS keeps entries for 4 hours by default, while computers and phones usually keep them for much less, from seconds to minutes.

Try it yourself

Look at your own ARP cache:

• Windows: open Command Prompt and run arp -a.
• Mac or Linux: run arp -a in Terminal. On Linux, ip neigh shows the same table.

You'll almost always see your default gateway's IP in the list, with its MAC next to it.

Good to know

• ARP (RFC 826) is for IPv4. IPv6 uses Neighbor Discovery instead.
• The request is a broadcast; the reply is normally unicast.
• For destinations on another subnet, the computer ARPs for its default gateway's MAC, not the far server's.
• Cache timeouts vary by OS (Cisco IOS keeps entries 4 hours by default).

For CCNA learners

This lines up with CCNA 200-301 exam topic 1.13, describe switching concepts: know that an ARP request is a broadcast the switch floods to every port in the VLAN, while the reply comes back as a unicast frame.

Answer to the comment question

No. The request is a broadcast because your PC doesn't yet know who has the IP, but the owner does know who asked: the request carries your PC's IP and MAC. So the ARP reply is normally unicast, sent straight back to the PC that asked, not to everyone.