ARP Explained: Resolve IP to MAC Addresses (2026)

ARP is the unsung hero that makes your local network function, but it’s not actually about resolving IP addresses to MAC addresses; it’s about broadcasting a question to everyone on the network and hoping the right machine answers.

Let’s see this in action. Imagine your machine (IP 192.168.1.10, MAC AA:BB:CC:DD:EE:FF) wants to send a packet to another machine on the same local network (IP 192.168.1.20). Your machine knows the IP address, but to actually send the Ethernet frame, it needs the destination MAC address.

Here’s what happens:

1. ARP Request: Your machine creates an ARP request packet. This packet essentially says, "Hey everyone on this network segment, who has the IP address 192.168.1.20? Please tell me your MAC address." This request is broadcast to all devices on the local network.

   Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
   ...
   Ethernet II, Src: AA:BB:CC:DD:EE:FF (your_mac), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
   Internet Protocol Version 4, Src: 192.168.1.10 (your_ip), Dst: 192.168.1.20 (target_ip)
   Address Resolution Protocol (request)
       Hardware type: Ethernet (0x0001)
       Protocol type: IPv4 (0x0800)
       Hardware address length: 6
       Protocol address length: 4
       Opcode: request (0x0001)
       Sender MAC address: AA:BB:CC:DD:EE:FF (your_mac)
       Sender IP address: 192.168.1.10 (your_ip)
       Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
       Target IP address: 192.168.1.20 (target_ip)
   

2. ARP Reply: The machine with the IP address 192.168.1.20 (let’s say its MAC is 11:22:33:44:55:66) receives this broadcast. It recognizes its own IP address and constructs an ARP reply. This reply says, "I am 192.168.1.20, and my MAC address is 11:22:33:44:55:66." This reply is unicast directly back to your machine’s MAC address.

   Frame 2: 42 bytes on wire (336 bits), 42 bytes captured (336 bits)
   ...
   Ethernet II, Src: 11:22:33:44:55:66 (target_mac), Dst: AA:BB:CC:DD:EE:FF (your_mac)
   Internet Protocol Version 4, Src: 192.168.1.20 (target_ip), Dst: 192.168.1.10 (your_ip)
   Address Resolution Protocol (reply)
       Hardware type: Ethernet (0x0001)
       Protocol type: IPv4 (0x0800)
       Hardware address length: 6
       Protocol address length: 4
       Opcode: reply (0x0002)
       Sender MAC address: 11:22:33:44:55:66 (target_mac)
       Sender IP address: 192.168.1.20 (target_ip)
       Target MAC address: AA:BB:CC:DD:EE:FF (your_mac)
       Target IP address: 192.168.1.10 (your_ip)
   

3. ARP Cache: Your machine receives the ARP reply and stores this IP-to-MAC mapping (192.168.1.20 -> 11:22:33:44:55:66) in its ARP cache. This cache is a temporary table that avoids sending out ARP requests for every single packet.

   You can view your ARP cache on Linux/macOS with arp -a or on Windows with arp -a.

The core problem ARP solves is bridging the gap between Layer 3 (IP addresses, logical addressing) and Layer 2 (MAC addresses, physical addressing) within a local network segment. Without ARP, devices wouldn’t know how to physically address frames to send them to the correct recipient on the same subnet. Routers use ARP to determine the MAC address of the next-hop gateway when forwarding packets between networks.

The surprising part is that ARP requests are broadcast to everyone, and every machine on the subnet processes the ARP request, even though only one machine is the intended recipient. This broadcast nature is a key characteristic. Also, ARP replies are often gratuitous, meaning a machine might send an ARP reply without being asked, often when its IP or MAC address changes, to update other machines’ caches proactively. For instance, if a server’s network interface is replaced, it might send a gratuitous ARP with its IP and new MAC to ensure other devices update their ARP tables.

The ARP cache is not permanent. Entries typically expire after a certain time (e.g., 2-4 minutes on many systems) to ensure that if a device’s MAC address changes, other devices will eventually send out new ARP requests and get the updated information. This dynamic nature is crucial for network stability, especially in environments where devices might join or leave the network frequently.