Ethernet provides local-link delivery. Hosts and switches use MAC addresses so frames can reach the correct interface on the current LAN segment. ARP bridges a semantic gap: an application or IP layer may know an IPv4 destination, while the local link still needs a destination MAC address.
Remember the shape, not the sentence
“Imagine knowing someone's apartment number but not the name of the person at the building door. ARP is the local directory request that asks, 'Who currently owns this IP on this link?'”
Ethernet framing
A frame includes source and destination MAC addresses plus an EtherType/length field and an FCS for integrity checking. The precise wire representation includes additional fields such as preamble and inter-frame gap.
ARP is local
ARP broadcasts a request on the local broadcast domain, but the reply is normally unicast. Routers terminate the local ARP process; a router does not forward an Ethernet broadcast into the next LAN as if the two LANs were one.
MAC addresses are local identifiers
A MAC address identifies an interface at the link layer. When a packet crosses routers, the Ethernet frame is replaced for the next link, so the source/destination MAC pair normally changes hop by hop.
See the mechanism before you memorize it
One diagram, one causal story, one reconstruction task.
Ethernet frames, MAC addresses, ARP in action — causal map
1
Host determines the destination IP is local or needs the default gateway.
2
If local IPv4 delivery is needed and the MAC is unknown, ARP requests the mapping.
3
The owner replies with its MAC address.
4
The sender caches the result and builds an Ethernet frame.
Draw the idea yourself
Rebuild the core flow on a real canvas before moving to the worked walkthrough.
Walk the system
1
Host determines the destination IP is local or needs the default gateway.
2
If local IPv4 delivery is needed and the MAC is unknown, ARP requests the mapping.
3
The owner replies with its MAC address.
4
The sender caches the result and builds an Ethernet frame.
5
The switch forwards the frame based on its learned MAC table.
Observe ARP
The neighbor table is the artifact to inspect when a host can reach the IP network conceptually but cannot form local link-layer delivery.
ip neigh
arp -a
# Linux packet capture hint
tcpdump -ni any arpWhat usually goes wrong
Close the tab. Rebuild it from memory.
Read the question, answer aloud, then reveal.
What question does an ARP request answer?Reveal answer
Which interface owns this IPv4 address on the local broadcast domain, and therefore which MAC should receive the frame?
Why does the default gateway have a MAC address?Reveal answer
Because the host's next-hop frame still needs a local Layer 2 destination, even when the final IP destination is on another network.
Who learns MAC-to-port mappings?Reveal answer
A switch learns from the source MAC address of incoming Ethernet frames and associates that MAC with the ingress port.
Make this idea travel.
Connect it next to: arp • switches-vlans • frame-trace.