What Is ARP? How Devices Find MAC Addresses

What Is ARP? How Devices Find MAC Addresses
Networking ATN Campus September 25, 2026 50 views

What Is ARP? How Devices Find MAC Addresses?

```

ARP (Address Resolution Protocol) is a fundamental protocol used in IPv4 networks to discover the MAC address associated with a known IPv4 address on the local network.

When a device wants to communicate with another device on the same local network, knowing the destination IP address is not enough. Ethernet communication also requires a destination MAC address. ARP helps the device discover that MAC address.

In this guide, we will learn how ARP works, how ARP Request and Reply messages work, what an ARP cache is, how devices resolve the MAC address of their default gateway, and how to troubleshoot common ARP problems.

```

What Is ARP?

```

ARP stands for Address Resolution Protocol. It is used in IPv4 networks to map an IPv4 address to a MAC address on the local network. 

    IPv4 Address
         |
         | ARP
         v
    MAC Address

    Example:

    192.168.1.20
         |
         v
    AA:BB:CC:DD:EE:FF

ARP is primarily a local-network mechanism. A host does not use ARP to discover the MAC address of a remote Internet server. Instead, when sending traffic to a remote network, the host normally resolves the MAC address of its local default gateway.

```

Why Do We Need ARP?

```

Consider two computers connected to the same switch. 

    PC-A                         PC-B
    IP: 192.168.1.10             IP: 192.168.1.20
    MAC: AA:AA:AA:AA:AA:AA       MAC: BB:BB:BB:BB:BB:BB
         |                            |
         +---------- Switch ----------+

PC-A knows that PC-B has the IP address 192.168.1.20, but Ethernet needs a destination MAC address.

PC-A therefore uses ARP to ask: 

    "Who has 192.168.1.20?"

PC-B responds with its MAC address.

```

How Does ARP Work?

```

ARP communication commonly involves two messages:

  1. ARP Request
  2. ARP Reply
    PC-A
     |
     | ARP Request
     | "Who has 192.168.1.20?"
     v
   Switch
     |
     +------------------+
     |                  |
     v                  v
   PC-B              Other Hosts

     |
     | ARP Reply
     | "192.168.1.20 is
     |  BB:BB:BB:BB:BB:BB"
     v
    PC-A
```

What Is an ARP Request?

```

An ARP Request is sent when a device needs to discover the MAC address associated with an IPv4 address on the local network.

The request is normally sent as a Layer 2 broadcast because the sender does not yet know which device owns the target IPv4 address. 

    PC-A:

    "Who has 192.168.1.20?"

            |
            v
    Ethernet Broadcast
            |
    +-------+-------+
    |       |       |
    PC-B    PC-C    PC-D

    Only PC-B should respond
    if it owns 192.168.1.20.
```

What Is an ARP Reply?

```

The device that owns the requested IPv4 address can respond with an ARP Reply containing its MAC address. 

    PC-B

    IP:
    192.168.1.20

    MAC:
    BB:BB:BB:BB:BB:BB

          |
          | ARP Reply
          v

    PC-A learns:

    192.168.1.20
    =
    BB:BB:BB:BB:BB:BB
```

ARP Request vs ARP Reply

```
Feature ARP Request ARP Reply
Purpose Find the MAC address Provide the MAC address
Typical delivery Broadcast Usually unicast to the requester
Example Who has 192.168.1.20? 192.168.1.20 is at BB:BB:BB:BB:BB:BB
```

What Is an ARP Cache?

```

Devices usually do not want to send an ARP Request every time they communicate with another local device.

Instead, they temporarily store recently learned IP-to-MAC mappings in an ARP cache. 

    ARP Cache

    +------------------+-------------------------+
    | IPv4 Address     | MAC Address             |
    +------------------+-------------------------+
    | 192.168.1.20     | BB:BB:BB:BB:BB:BB      |
    | 192.168.1.30     | CC:CC:CC:CC:CC:CC      |
    +------------------+-------------------------+

The cache is temporary and entries can expire or be refreshed according to the operating system and network device behavior.

```

What Happens When the Destination Is on Another Network?

```

This is one of the most important ARP concepts.

Suppose a computer with IP address 192.168.1.10 wants to communicate with a server at 192.168.2.20. 

    PC
    192.168.1.10
         |
         v
    Default Gateway
    192.168.1.1
         |
         v
    Router
         |
         v
    192.168.2.0/24
         |
         v
    Server
    192.168.2.20

PC-A does not ARP for the remote server's MAC address. Instead, it normally ARPs for the MAC address of its default gateway, 192.168.1.1. 

    PC-A asks:

    "Who has 192.168.1.1?"

            |
            v

    Router replies:

    "192.168.1.1 is at
     RR:RR:RR:RR:RR:RR"

PC-A then sends the Ethernet frame to the router's MAC address. The IP packet still has the remote server's IP address as its destination.

```

ARP and the Default Gateway

```

A useful way to remember the concept is: 

    Same Network
    ------------

    ARP for the destination host's MAC.


    Different Network
    -----------------

    ARP for the default gateway's MAC.

This distinction is essential when troubleshooting IPv4 connectivity.

```

ARP Process Example

``` 
    PC-A
    IP: 192.168.10.10
         |
         |
         v
    Switch
         |
         |
    PC-B
    IP: 192.168.10.20


    Step 1:
    PC-A checks its ARP cache.

    Step 2:
    Entry does not exist.

    Step 3:
    PC-A sends ARP Request.

    Step 4:
    PC-B receives the request.

    Step 5:
    PC-B sends ARP Reply.

    Step 6:
    PC-A stores the mapping.

    Step 7:
    PC-A sends the Ethernet frame.
```

Viewing the ARP Cache

```

Windows

```

C:> arp -a
```

Linux

```

$ ip neigh
```

Cisco IOS

```

Router# show ip arp
```

The exact output varies by operating system and device platform.

```

ARP and the OSI Model

```

ARP operates between concepts commonly associated with the Network Layer and Data Link Layer because it resolves an IPv4 address to a Layer 2 hardware address for local delivery. 

    Layer 3
    IPv4 Address
         |
         | ARP
         v
    Layer 2
    MAC Address
```

Common ARP Problems

```

1. Incorrect ARP Entry

If a device has an incorrect IP-to-MAC mapping, traffic may be delivered to the wrong Layer 2 destination.

2. ARP Cache Problems

Clearing or refreshing an ARP cache can sometimes help diagnose stale or incorrect neighbor information.

3. Duplicate IP Addresses

If two devices use the same IPv4 address, ARP behavior can become inconsistent and connectivity problems may occur.

4. Gateway Resolution Failure

If a host cannot resolve the MAC address of its default gateway, communication outside the local subnet may fail.

```

ARP Security: ARP Spoofing

```

ARP does not provide strong authentication for ARP messages. An attacker on a local network may attempt to send forged ARP information to associate an attacker's MAC address with another device's IPv4 address.

This is commonly called ARP spoofing or ARP poisoning.

Network security features such as Dynamic ARP Inspection, together with DHCP Snooping and other controls, can help reduce this type of risk in supported network designs.

```

Practical ARP Lab

``` 
    PC-A
    192.168.1.10
         |
         |
      Switch
         |
         |
    PC-B
    192.168.1.20

Lab Objectives

  1. Assign IPv4 addresses to two PCs.
  2. Verify local connectivity.
  3. Clear or inspect the ARP cache.
  4. Ping the second PC.
  5. Observe the ARP cache after the ping.
  6. Identify the IP-to-MAC mapping.
  7. Add a router and observe the gateway MAC resolution.
```

Quick ARP Quiz

```

1. What does ARP stand for?

Show Answer

Address Resolution Protocol.

2. What does ARP resolve?

Show Answer

An IPv4 address to a MAC address for local network delivery.

3. What is an ARP Request?

Show Answer

A request asking which device owns a particular IPv4 address and requesting its MAC address.

4. What is an ARP cache?

Show Answer

A temporary table containing recently learned IP-to-MAC mappings.

5. For a remote destination, whose MAC address does the host normally need?

Show Answer

The MAC address of the local default gateway.

```

Key Takeaways

```
  • ARP maps IPv4 addresses to MAC addresses for local delivery.
  • An ARP Request asks who owns an IPv4 address.
  • An ARP Reply provides the corresponding MAC address.
  • Devices temporarily store mappings in an ARP cache.
  • For remote destinations, a host normally ARPs for its default gateway.
  • ARP is an important part of IPv4 troubleshooting.
  • ARP spoofing is an important local-network security concern.
```
```

Want to Learn ARP and Networking? Visit ATN Campus

Want to learn ARP, IPv4, routing, switching, VLANs, subnetting, network security, and troubleshooting through practical training?

Visit ATN Campus and learn networking through theory, hands-on Cisco labs, real-world scenarios, and practical troubleshooting exercises.

Learn More Than Just ARP

  • CCNA – Cisco Certified Network Associate
  • CCNP – Cisco Certified Network Professional
  • IPv4 & IPv6 Networking
  • Routing & Switching
  • ARP, DHCP & DNS
  • Subnetting & IP Addressing
  • Network Security
  • CEH – Certified Ethical Hacker
  • Cisco CyberOps
  • Python for Network Automation
  • Practical Cisco Networking Labs

Whether you are a beginner, preparing for CCNA or CCNP, or building practical networking troubleshooting skills, ATN Campus helps you move from theory to hands-on experience.

???? Want to learn networking? Visit ATN Campus.

???? Learn Networking. ???? Master Routing & Switching. ???? Practice with Real Labs. ???? Prepare for Certifications. ???? Build Your IT Career with ATN Campus.
```

Share this article:

Facebook Twitter WhatsApp LinkedIn
Related Articles
Networking
Network Engineer Career Roadmap: From Student to Network Professional
Networking
What Is a Reverse Proxy? Nginx, HTTPS and Web Applications
Networking
What Is a Load Balancer? How Websites Handle Millions of Users
Back to All Articles
Recent Posts
Categories
Networking 105 Cyber Security 9 Career 6 Python 4 Cloud 4
Document ATN CAMPUS