how/network

How ARP finds a MAC from an IP

You know the IP, but how does the packet even leave the network card? First you need the neighbor's MAC. ARP does this with one broadcast.

You know the IP address of a neighbor on the network, say 192.168.1.20. But the network card cannot work with IP. It deals in [[mac-address| MAC addresses]], the "number" of a physical network interface, like bb:bb:bb:22:22:22.

To send any packet, the laptop must wrap it in an [[ethernet-frame|Ethernet frame]]. And in the frame, the recipient slot needs a MAC, not an IP. Where do you get it if all you know is the IP?

ARP (Address Resolution Protocol) is that "directory service": you send a broadcast "who has 192.168.1.20?", and the owner answers "that's me, my MAC is such and such". You remember it, then send directly from there on.

Press ▶ to see how this exchange happens in 2 packets.

step 1/4·00 · need to send, neighbor's MAC unknown

§ steps

Host A wants to send a packet to 192.168.1.20. From the subnet mask it figures out: "this is my network, I send directly".

But the [[ethernet-frame|Ethernet frame]] needs the recipient's MAC, and it is not in the cache:
bash
$ ip neigh
# (empty for 192.168.1.20)
Without the MAC, the frame cannot be built. You have to ask.

recap

What to keep in mind:

An ARP request is an [[broadcast-domain|L2 broadcast]] to FF:FF:FF:FF:FF:FF. The switch must flood it to all ports, so every neighbor receives the request, but only the one whose IP matched answers
The reply goes point to point (unicast). The switch already knows which port the laptop is on and sends the reply only there
The laptop remembers the IP↔MAC pairing in a cache (the neighbor table). When you need it again, there is no need to broadcast a second time
ARP works only inside one broadcast domain. It does not cross a router, where [[routing-table|routing]] takes over
In IPv6, ARP is replaced by NDP (over ICMPv6), but the idea is the same

To see your ARP cache live, run ip neigh.

§ dig into the knowledge base

§ steps

Host A wants to send a packet to 192.168.1.20. From the subnet mask it figures out: "this is my network, I send directly".

But the [[ethernet-frame|Ethernet frame]] needs the recipient's MAC, and it is not in the cache:

bash

$ ip neigh

# (empty for 192.168.1.20)

Without the MAC, the frame cannot be built. You have to ask.