Address Resolution Protocol (ARP)

The Address Resolution Protocol (ARP) is an essential protocol for local IPv4 communication.
It allows devices on the same network to discover each other by linking IP addresses to MAC addresses.

Let’s break it down with a simple example between PC1 and PC2 on a local network.

The Starting Point

Imagine this: you’re sitting behind PC1, and you want to ping your friend’s PC2 on the same subnet.
You already know PC2’s IP address (192.168.1.2), so you send a ping request.

But there's a problem because your device doesn't know PC2's MAC address.

Figure 1 – PC1 Needs the MAC Address of PC2

PC1 knows where PC2 is logically (its IP), but not physically (its MAC).
It’s like knowing a person’s name but not their phone number; you can’t contact them directly.

Why the MAC Address Matters

Your computer needs both the IP address and the MAC address of the destination device to send data.
The IP identifies who the device is, while the MAC identifies where it is on the local network.

Without the MAC address, your frame has no destination, and it cannot leave the interface.

The Role of ARP in the OSI Model

The Address Resolution Protocol (ARP) links IP addresses to MAC addresses, allowing devices on the same local network to communicate directly.

In our example, ARP helps PC1 find PC2’s MAC address (192.168.1.2 → BB:BB:BB:BB:BB:BB) so they can exchange data successfully.

Figure 2 - ARP Between Layer 2 and Layer 3

ARP operates at the boundary between Layer 2 (Data Link) and Layer 3 (Network) of the OSI model.
It acts as a translator between logical addressing (IP) and physical addressing (MAC).

Every time you send data over a LAN, ARP silently works in the background, making sure each IP packet has the correct MAC address before it leaves the interface.

Now that you understand why ARP exists, let’s see how it actually works in action.
You’re about to send a ping from PC1 to PC2 on the same network.
What happens step by step?

Step 1 — Checking the ARP Table

When you type ping 192.168.1.2 and press Enter, the first thing your computer does is check its ARP table.
This table stores known IP-to-MAC address mappings that your device has already learned.

Figure 2 – PC1 tries to ping PC2 at 192.168.1.2

Your computer looks for the MAC address associated with 192.168.1.2.
If it finds it, it can send the ping immediately.
If not, it must discover it, and that’s where the ARP process begins.

You can view this table on Windows with the command:

C:\> arp -a

If the table is empty, PC1 doesn’t know PC2’s MAC address yet.
It needs to ask the network for help.

Step 2 — Sending the ARP Request

If the MAC address isn’t found, PC1 sends an ARP Request, asking:

Figure 3 – Sending the ARP Request

This ARP Request is broadcast to every device on the local network.
Since PC1 doesn’t know which device is PC2, it sends the message to everyone.

Here’s what the ARP Request looks like:

Table 1 – ARP Request Fields (PC1 → PC2)

Here’s what’s happening:
PC1 is announcing its own MAC and IP, while asking, “Who owns this IP address 192.168.1.2?”
Every device can receives the message, but only PC2 will recognize its own IP address in the Target IP field.

Step 3 - Receiving the ARP Reply

When PC2 receives the ARP Request, it checks the Target IP field.
Since it matches its own IP address (192.168.1.2), PC2 knows the message is meant for it.

Figure 4 – Receiving the ARP Reply

PC2 then sends an ARP Reply directly to PC1, announcing its MAC address.
This message is unicast, meaning it’s sent only to PC1 and not to everyone else.

Table 2 – ARP Reply Fields (PC2 → PC1)

This reply simply says:

“I am 192.168.1.2, and my MAC address is BB:BB:BB:BB:BB:BB.”

Step 4 - Updating the ARP Table

Once PC1 receives the ARP Reply, it updates its ARP table with PC2’s information.

C:\> arp -a

Interface: 192.168.1.1  0xb
  Internet Address      Physical Address      Type
  192.168.1.2           BB-BB-BB-BB-BB-BB     dynamic

From now on, PC1 can communicate directly with PC2 without sending another ARP Request.

ARP entries are temporary.
On PCs, they expire after a few minutes.
On Cisco devices, they typically last 4 hours by default, but you can adjust this value with the arp timeout command.

To view ARP entries on a Cisco device:

SW1# show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.1             -   aaaa.aaaa.aaaa  ARPA   Gig0/0
Internet  192.168.1.2             2   bbbb.bbbb.bbbb  ARPA   Gig0/1

This shows the same IP-to-MAC mapping directly on the switch.

When ARP Fails

If no device replies to the ARP Request, for example, if PC2 is turned off or disconnected then PC1 cannot learn the MAC address it needs to send the frame.

In this case, the ping fails, and you’ll see an error such as:

Request timed out

Now that PC1 has learned PC2’s MAC address, it can finally send the ping request.

When you ping 192.168.1.2, your computer first checks its ARP table to retrieve PC2’s MAC address.
Since the mapping now exists, the packet can be sent directly to PC2 without any additional ARP process.

Figure 5– ICMP Echo Request Sent After ARP Resolution

At this point, the communication happens smoothly. The ICMP Echo Request is encapsulated in an Ethernet frame that includes PC2’s MAC address, and PC2 responds with an Echo Reply, confirming that connectivity works as expected.

So, how does the Address Resolution Protocol (ARP) really work?
It acts as a bridge between IP and MAC addresses, allowing devices on the same subnet to communicate seamlessly.

Without ARP, even knowing a device’s IP address wouldn’t be enough because your computer wouldn’t know where to send the frame at Layer 2.

Key Points to Remember

• Once resolved, communication can occur directly over the Data Link layer.

• ARP connects logical addressing (IP) with physical addressing (MAC).

• If the MAC address is unknown, ARP dynamically discovers it by sending a broadcast request.

Understanding how ARP works gives you a clear view of one of the most fundamental mechanisms in IPv4 communication the silent translator that makes every local network exchange possible.