Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 29

ARP: IP to MAC Address Mapping

Recommended resources

Hello! Welcome to a new module where we'll explore some of the essential "helper" protocols that make the internet work seamlessly behind the scenes.

In the previous module, we took a deep dive into IP addressing. You learned how IP addresses (both IPv4 and IPv6) act like a postal address, giving every device a unique, routable identifier on the global internet (Layer 3). Earlier, in Module 4, we saw how MAC addresses are permanent, hardware-level identifiers used for communication within a single local network (Layer 2).

This brings up a fundamental question: How do these two layers connect? When your computer wants to send data to another device on your local Wi-Fi, it knows the other device's IP address, but the underlying network hardware (your switch or Wi-Fi access point) only understands MAC addresses. How does your computer translate the destination IP address into the correct destination MAC address?

This lesson will answer that question. We will focus on the Address Resolution Protocol (ARP), the crucial mechanism that maps IP addresses to MAC addresses on a local network.

1. The Two-Address Problem: IP vs. MAC

To understand why ARP is necessary, it's vital to be clear on the different roles of IP and MAC addresses. Think of it like sending a package to a colleague in a large office building.

  • IP Address (Layer 3): This is like the building's street address (e.g., "123 Innovation Drive, Tech Park"). It's a logical address that gets your package to the correct network (the office building). Routers on the internet use this address to guide your data across different networks.
  • MAC Address (Layer 2): This is like your colleague's specific office number and name (e.g., "Office 404, Jane Doe"). It's a physical, permanent address. Once the package arrives at the building, the local mailroom (the network switch) needs this specific information to deliver it to the correct person's desk (the device's network card).

ARP acts as the building's directory service. When a device knows the IP address it wants to reach on its local network, it uses ARP to look up the corresponding MAC address so it can address the final delivery.

Understanding ARP Networking and Its Role in Communication

This article offers a good summary of the distinct roles of IP and MAC addresses and how ARP bridges them. The dialogue format provides a relatable context for the problem.

Read the section titled 'Understanding the Relationship Between MAC Address and IPV4 Address'. Focus on the descriptions of what a MAC address and an IPv4 address are, and the key points under 'How It Works'.

2. The ARP Conversation: Request and Reply

So, how does this "lookup" actually happen? ARP uses a simple and elegant two-step conversation. Let's say your computer (PC-A) wants to send data to another computer on your home network (PC-B).

  1. Check the Cache: First, PC-A checks its ARP cache, a small table in its memory that stores recent IP-to-MAC address mappings. If it finds an entry for PC-B's IP address, it simply uses the stored MAC address and the process ends here. This is efficient.

  2. ARP Request (Broadcast): If there's no entry in the cache, PC-A crafts an ARP Request. This is a message that essentially shouts to everyone on the local network:

    "Who has the IP address 192.168.1.50? Tell 192.168.1.25 (me)."

    This request is sent inside an Ethernet frame with the special broadcast destination MAC address FF:FF:FF:FF:FF:FF. The switch sees this and forwards the frame to every single device on the network.

  3. ARP Reply (Unicast): Every device on the network receives the ARP Request.

    • Devices that do not have the IP address 192.168.1.50 see that the request isn't for them and simply discard it.
    • PC-B, which does have the IP address 192.168.1.50, recognizes its own IP in the request. It then prepares an ARP Reply. This reply is a direct, unicast message sent only to PC-A's MAC address (which was included in the original request). The reply says:

    "I have the IP address 192.168.1.50, and my MAC address is E8:6A:64:7B:3E:1A."

  4. Update Cache and Communicate: PC-A receives the reply, adds the new IP-to-MAC mapping to its ARP cache for future use, and can now send its original data to PC-B.

This video provides a great animation of this exact process.

ARP Explained | Address Resolution Protocol

To see how ARP works in action, let's watch this excellent animation. It clearly illustrates the problem and the two-step process of an ARP request and reply.

Watch the first 2 minutes and 48 seconds of this video from CertBros. Pay close attention to the difference between the 'shout out' (broadcast) and the direct reply (unicast).

This diagram visually summarizes the broadcast request and unicast reply, which is the core of the ARP mechanism.

ARP Request and Reply Process
This diagram shows the two-stage ARP process. System A sends a broadcast ARP request to the entire local network. Only System B, which owns the target IP address, responds with a unicast ARP reply containing its MAC address.

3. What's Inside an ARP Packet?

Given your computer science background, you'll likely be interested in the actual structure of the messages being exchanged. An ARP message isn't very complex, but it contains all the necessary information for this mapping process.

The key fields are:

  • Operation Code (OPER): A simple field that specifies if the packet is a request (value 1) or a reply (value 2).
  • Sender Hardware Address (SHA): The MAC address of the device sending the packet.
  • Sender Protocol Address (SPA): The IP address of the device sending the packet.
  • Target Hardware Address (THA): The MAC address of the intended receiver. In a request, this is unknown and often left blank or set to zeros. In a reply, this is filled with the MAC address that was requested.
  • Target Protocol Address (TPA): The IP address of the device whose MAC is being sought.

Let's look at how these fields are used in our example:

In the ARP Request from PC-A:

  • SHA: PC-A's MAC
  • SPA: PC-A's IP
  • THA: 00:00:00:00:00:00 (it's unknown)
  • TPA: PC-B's IP

In the ARP Reply from PC-B:

  • SHA: PC-B's MAC
  • SPA: PC-B's IP
  • THA: PC-A's MAC
  • TPA: PC-A's IP

The following reading breaks down each field in more detail.

Understanding ARP Networking in IoT & Its Role in Communication

Let's look under the hood at the structure of an ARP message. This article provides a clear breakdown of the fields in an ARP packet, which is essential for analyzing them later.

Read the section titled 'ARP Message Structure'. You don't need to memorize every field, but focus on understanding the purpose of the key operational fields like Operation, Sender/Target Protocol Address (IP), and Sender/Target Hardware Address (MAC).

4. Special Case: ARP for an Outside Network

A logical next question is: what if your computer wants to communicate with a server on the internet, like google.com? Its IP address is not on your local network. Does your computer broadcast an ARP request across the entire internet for Google's MAC address?

The answer is no. ARP is strictly a local network protocol.

When your computer determines that a destination IP address is on a different network, it knows it can't deliver the data directly. Instead, it must hand the data to its default gateway (your home router) to be forwarded toward the destination.

In this scenario, the ARP process happens, but with a different target:

  1. Your computer needs to send a packet to Google (IP 142.250.187.206).
  2. It compares this IP to its own network configuration and sees it's on a remote network.
  3. Therefore, it needs to find the MAC address of its local default gateway (e.g., router at 192.168.1.1).
  4. It sends an ARP request asking, "Who has 192.168.1.1?"
  5. Your router replies with its MAC address.
  6. Your computer then sends the Ethernet frame containing the Google-bound IP packet to the router's MAC address. The router takes it from there.

This video segment explains this crucial distinction clearly.

ARP Explained | Address Resolution Protocol

So what happens when the destination is outside the local network? This segment explains how ARP is used to find the default gateway, not the final destination.

Watch the segment from 06:22 to 08:15. Notice how the computer ARPs for the MAC address of its default gateway (the router) because it knows the web server is not on the same local network.

Conclusion

In this lesson, we unraveled the mystery of how network devices translate logical IP addresses into physical MAC addresses. ARP is a simple but vital protocol that functions as the bridge between Layer 3 and Layer 2, making communication on a local network possible.

Key Takeaways:

  • ARP's purpose is to map a known IP address to an unknown MAC address on a local network.
  • The process involves a broadcast ARP Request sent to all devices and a unicast ARP Reply sent directly back from the target device.
  • The ARP cache stores these mappings temporarily to avoid unnecessary broadcasts and improve efficiency.
  • When a device needs to communicate outside its local network, it uses ARP to find the MAC address of its default gateway (router).

Preview of the Next Lesson:
Theory is great, but seeing this in action is even better. In our next lesson, you'll get your hands dirty with Wireshark, a powerful network analysis tool. You will learn how to capture the network traffic on your own computer and see these very ARP requests and replies for yourself. This will be a fantastic opportunity to connect this "book knowledge" directly to real-life network activity.