Two addresses, two jobs
Suppose a laptop wants to send data to a printer on the same Ethernet network. The laptop may know the printer’s IPv4 address, but that alone is not enough to build an Ethernet frame. The frame also needs a destination MAC address so it can be delivered on the local link. Address Resolution Protocol, or ARP, helps the laptop find the MAC address associated with that local IPv4 address.
IP addresses describe where traffic should go at the network layer. MAC addresses identify interfaces for delivery at the link layer. A MAC address is commonly written as six pairs of hexadecimal digits, such as 02:1A:2B:3C:4D:5E. Although MAC addresses are often called hardware addresses, they are not always permanent: software can assign or change the address an interface uses.
These roles matter because an IP packet and the Ethernet frame carrying it have different destinations. A packet can retain a distant destination IP address while its enclosing frame is addressed to the next device on the local network.
What happens during an ARP lookup
Before sending to a local IPv4 address, a device checks its ARP cache, a table of recently learned IP-to-MAC mappings. If a usable entry is present, it can address the Ethernet frame without asking again. If not, it sends an ARP request that is broadcast within the local network segment, effectively asking which interface uses the target IPv4 address.
The device using that address normally answers with an ARP reply containing its MAC address. The sender can then record the mapping in its cache and send the frame. Cache entries are refreshed or removed over time; an old mapping should not be assumed to remain correct after a device changes interfaces or addresses.
ARP is for IPv4. IPv6 uses Neighbor Discovery, which serves a related address-resolution purpose but works differently. ARP requests also do not travel across routers, so a device cannot use one to discover the MAC address of a host somewhere else on the internet.
Local destination or next-hop router?
A device first uses its IP configuration and routing table to decide where to send a packet. If the destination is reachable directly on the local network, it needs the destination device’s MAC address. If the destination is on another network, it instead sends the packet to a next-hop router, often the configured default gateway.
For example, when a laptop opens a website outside its local network, the IP packet names the website server as its destination. On the first Ethernet link, however, the frame is addressed to the router’s MAC address. The laptop may use ARP to learn that address. The router then forwards the packet, placing it in a new link-layer frame appropriate for the next link. The laptop does not need the remote server’s MAC address.
Where the switch fits in
ARP resolves an IPv4 address to a MAC address; an Ethernet switch performs a different task. A switch learns which MAC addresses it sees on its ports by examining the source addresses of incoming frames. It uses that information to forward frames toward the appropriate port when it knows where the destination MAC is located.
An ARP request is an Ethernet broadcast, so a switch typically forwards it throughout the relevant broadcast domain, such as the same VLAN, rather than across every network in an organization. If a switch does not yet know the destination of an ordinary unicast frame, it may temporarily flood that frame within the VLAN. Its learned MAC table and a host’s ARP cache are separate tables that answer different questions.
A practical way to troubleshoot
When two IPv4 devices cannot communicate, start with the path they should use. Check the sender’s IP address, subnet configuration and route: does it expect to reach the destination directly, or through a gateway? Then inspect its ARP cache using the tools available on its operating system. A missing entry after an attempted connection can suggest that an ARP request went unanswered, though it does not by itself identify the cause.
Next, consider the local link. Are both devices connected to the intended VLAN? Is the target interface active and using the expected IPv4 address? If the traffic should leave the local network, check whether the sender can resolve the next-hop router’s MAC address rather than looking for the remote host’s address.
ARP replies can also be misleading if a device is misconfigured or deliberately impersonates another address. Treat an unexpected IP-to-MAC mapping as a clue to investigate, not proof of an attack. The central troubleshooting distinction is simple: IP routing chooses a next hop, ARP finds that next hop’s MAC address on an IPv4 local link, and the switch delivers the resulting Ethernet frame.
