Ethernet, MAC Addresses, and ARP
IP addresses describe where traffic is routed between networks. On an Ethernet LAN, MAC addresses identify the local link endpoints carried in Ethernet frames. A switch forwards frames within a LAN; a router connects IP networks.
1. MAC addresses and Ethernet frames
Section titled “1. MAC addresses and Ethernet frames”A common Ethernet MAC address is 48 bits, written as six hexadecimal octets such as 02:1A:2B:3C:4D:5E. The first part of a globally administered address is allocated by IEEE as an organizational identifier, but a MAC address does not always reveal the manufacturer. Devices can use locally administered addresses, including randomized Wi-Fi addresses, and software can configure an address.
An Ethernet frame contains source and destination MAC addresses and a payload such as an IP packet. The Ethernet broadcast destination is FF:FF:FF:FF:FF:FF. A switch learns source MAC addresses on incoming ports and uses its forwarding database to send known unicast frames toward the correct port. Unknown unicast and broadcast frames are generally flooded within the VLAN, subject to switch behavior and policy.
2. ARP maps an IPv4 next hop to a MAC address
Section titled “2. ARP maps an IPv4 next hop to a MAC address”ARP (Address Resolution Protocol) helps an IPv4 host on an Ethernet-like local network learn the link-layer address associated with a local IPv4 next hop. If host A wants to send to host B on the same subnet and lacks a usable neighbor-cache entry, it broadcasts an ARP request asking which device owns B’s IP. B can reply with its MAC address, and A caches the mapping for a limited time.
If B is on a different subnet, A does not ARP for B’s remote MAC address. A sends the IP packet to its default gateway and resolves the gateway’s local MAC address instead. Each routed link has its own link-layer delivery information; the IP destination normally remains the final host while the Ethernet destination changes at each hop.
3. Observe the two tables
Section titled “3. Observe the two tables”A host’s ARP/neighbor cache maps an IPv4 neighbor to a link-layer address. A switch’s forwarding database maps learned MAC addresses to switch ports within a VLAN. These are different tables with different purposes.
Useful read-only checks include:
Windows: arp -aPowerShell: Get-NetNeighbor -AddressFamily IPv4Linux: ip neighSwitch CLI: show mac address-tableExact output and command syntax can vary by operating system or switch vendor. Do not clear a production cache or switch table just to force an example; use a disposable lab.
4. Common mistakes
Section titled “4. Common mistakes”- Calling every MAC address a permanent, globally unique hardware identity.
- Expecting the switch to route between IP subnets; that requires a Layer 3 device.
- ARPing for a remote destination instead of the local gateway.
- Confusing the host neighbor cache with the switch forwarding database.
- Treating MAC filtering as strong authentication; addresses can be changed or spoofed.
Practical exercise
Section titled “Practical exercise”In a private lab with two hosts on one subnet, inspect the neighbor cache, communicate between the hosts, then inspect it again. If a managed switch or simulator is available, compare its learned MAC table. Move one host to a different subnet and explain why the sender now resolves the gateway’s MAC instead.
What you should be able to do now
Section titled “What you should be able to do now”You should be able to describe switch learning, distinguish a neighbor cache from a switch table, and explain why ARP resolves a gateway for off-subnet traffic.