# How ARP Resolves IP Addresses to MAC Addresses

ARP (Address Resolution Protocol) is used in IPv4 networks to determine the MAC address associated with an IP address on the local network.

In simple terms, ARP connects Layer 3 addressing with Layer 2 addressing. A device uses an IP address to identify a destination, but Ethernet communication on the local network requires a MAC address.

When a destination is on another subnet, the host does not normally use ARP to find the remote host's MAC address directly. Instead, it resolves the MAC address of its default gateway, and the router handles forwarding the packet toward the destination network.

In this article, I will explain how ARP works and verify the process using a practical lab in Cisco Packet Tracer.

## What Is ARP?

ARP stands for **Address Resolution Protocol**.

In an IPv4 Ethernet network, ARP is used to resolve an IPv4 address into a MAC address.

For example, suppose PC-A wants to communicate with a device at:

```plaintext
192.168.10.1
```

PC-A may know the destination IP address, but Ethernet communication still needs a destination MAC address.

ARP allows PC-A to discover the MAC address associated with `192.168.10.1`.

The basic relationship is:

```plaintext
IPv4 address → MAC address
```

ARP is therefore an important part of communication in IPv4 Ethernet networks.

## Why Does a Host Need ARP?

An IPv4 address and a MAC address have different purposes.

An **IP address** provides logical addressing at Layer 3.

A **MAC address** is used for Layer 2 communication on the local Ethernet network.

For example:

```plaintext
IP address:
192.168.10.1

MAC address:
0001.c76b.5d01
```

A host may know the IP address it wants to communicate with, but it still needs a MAC address when sending an Ethernet frame on the local network.

This is where ARP becomes important.

## How Does ARP Work?

ARP communication generally involves two important messages:

1.  ARP Request
    
2.  ARP Reply
    

### 1\. ARP Request

Suppose PC-A needs to communicate with:

```plaintext
192.168.10.1
```

but PC-A does not yet know the corresponding MAC address.

PC-A sends an ARP Request asking:

```plaintext
Who has 192.168.10.1?
```

The request is broadcast on the local Ethernet network because PC-A does not yet know which MAC address owns that IP address.

Conceptually:

```plaintext
PC-A
  |
  | ARP Request
  | "Who has 192.168.10.1?"
  v
Local Network
```

The device that owns the requested IP address can respond.

### 2\. ARP Reply

The device with IP address `192.168.10.1` sends an ARP Reply containing its MAC address.

Conceptually:

```plaintext
PC-A
  ^
  | ARP Reply
  | "192.168.10.1 is at <MAC address>"
  |
Router
```

PC-A can then store the mapping in its ARP table and use it when sending Ethernet frames.

## What Is an ARP Table?

A host maintains an **ARP table**, which stores recently learned IP-to-MAC mappings.

You can inspect the ARP table on a Cisco Packet Tracer PC using:

```plaintext
arp -a
```

A simplified ARP table looks like this:

```plaintext
Internet Address      Physical Address      Type

192.168.10.1          0001.c76b.5d01        dynamic
```

This means the host has dynamically learned that:

```plaintext
192.168.10.1 → 0001.c76b.5d01
```

The mapping is marked as `dynamic` because it was learned through ARP rather than manually configured.

* * *

# Practical ARP Lab in Cisco Packet Tracer

To understand ARP more clearly, I used a simple network topology in Cisco Packet Tracer.

The topology contains:

*   2 PCs
    
*   2 Cisco 2960 switches
    
*   1 Cisco 1941 router
    

The network is divided into two `/26` subnets.

## Lab Topology

The topology is:

```plaintext
PC-A
192.168.10.10/26
     |
     |
Switch-A
     |
     |
Router
G0/0: 192.168.10.1/26
G0/1: 192.168.10.65/26
     |
     |
Switch-B
     |
     |
PC-B
192.168.10.70/26
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/96558644-0509-48a1-9984-357e5dae74c8.png align="center")

*Cisco Packet Tracer topology showing PC-A and PC-B connected through two switches and a router.*

The two subnets are:

```plaintext
192.168.10.0/26
192.168.10.64/26
```

PC-A belongs to the first subnet:

```plaintext
192.168.10.10/26
```

PC-B belongs to the second subnet:

```plaintext
192.168.10.70/26
```

Because they belong to different `/26` networks, communication between them requires the router.

* * *

## Checking the ARP Table Before Communication

Before performing the main communication test, I checked the ARP table on PC-A using:

```plaintext
arp -a
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/340b7aa0-9753-4f92-a27a-78b006fc209d.png align="center")

*PC-A ARP table before the main communication test.*

The purpose of this step is to establish a baseline and observe the ARP table before the communication test.

* * *

## Pinging the Default Gateway

Next, I tested connectivity between PC-A and its default gateway:

```plaintext
ping 192.168.10.1
```

*PC-A successfully pinging its default gateway at* `192.168.10.1`*.*

The ping was successful:

```plaintext
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)
```

This confirms that PC-A can communicate with the router interface on its local subnet.

* * *

## Checking the ARP Table After the Gateway Ping

After pinging the gateway, I checked the ARP table again:

```plaintext
arp -a
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/53e9baf4-8623-4b61-a8a4-9c828b9257c5.png align="center")

*PC-A ARP table showing a dynamic entry for the default gateway* `192.168.10.1`*.*

The ARP table contained:

```plaintext
Internet Address      Physical Address      Type

192.168.10.1          0001.c76b.5d01        dynamic
```

This is an important observation.

PC-A needed the MAC address of the router's local interface in order to send the Ethernet frame toward the gateway.

The ARP mapping is:

```plaintext
192.168.10.1
      ↓
0001.c76b.5d01
```

* * *

# What Happens When PC-A Pings PC-B?

Now PC-A needs to communicate with:

```plaintext
192.168.10.70
```

The destination is PC-B.

PC-A sends:

```plaintext
ping 192.168.10.70
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/784198d2-3ca2-4dbe-898b-23238855448d.png align="center")

*Caption: PC-A successfully pinging PC-B at* `192.168.10.70`*, demonstrating connectivity between the two* `/26` *subnets through the router.*

The test was successful:

```plaintext
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)
```

This confirms that the two different `/26` subnets can communicate through the router.

But there is an important question:

**If PC-A communicates with PC-B, why does PC-A's ARP table not contain PC-B's MAC address?**

The answer is related to subnetting and the default gateway.

* * *

## Checking the ARP Table After Pinging PC-B

After communicating with PC-B, I checked PC-A's ARP table again:

```plaintext
arp -a
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/f745b94d-8042-46ee-9cce-f63405c04d6f.png align="center")

*PC-A ARP table showing a dynamic entry for the default gateway* `192.168.10.1` *rather than the remote host* `192.168.10.70`*.*

The ARP table still showed the gateway:

```plaintext
192.168.10.1 → 0001.c76b.5d01
```

There was no ARP entry for:

```plaintext
192.168.10.70
```

This is expected.

PC-B is not on PC-A's local `/26` subnet.

PC-A belongs to:

```plaintext
192.168.10.0/26
```

while PC-B belongs to:

```plaintext
192.168.10.64/26
```

Therefore, PC-A does not need to resolve PC-B's MAC address directly.

Instead, PC-A resolves the MAC address of its **default gateway**.

* * *

# Why Does PC-A ARP for the Gateway Instead of PC-B?

This is one of the most important concepts in understanding ARP.

Before sending traffic, a host determines whether the destination IP address belongs to its own subnet.

For PC-A:

```plaintext
IP address:
192.168.10.10/26
```

Its local network is:

```plaintext
192.168.10.0/26
```

PC-B has:

```plaintext
192.168.10.70/26
```

Its network is:

```plaintext
192.168.10.64/26
```

Because the networks are different, PC-A knows that PC-B is a remote destination.

Therefore, PC-A sends the traffic to its default gateway:

```plaintext
192.168.10.1
```

PC-A needs the gateway's MAC address:

```plaintext
192.168.10.1
        ↓
0001.c76b.5d01
```

The Ethernet frame can then be addressed to the router's MAC address while the IP packet still has PC-B as its final destination.

Conceptually:

```plaintext
Ethernet Frame
Destination MAC:
Router's MAC

        +

IP Packet
Destination IP:
192.168.10.70
```

This distinction between Layer 2 and Layer 3 is essential for understanding how routed networks work.

* * *

# What Does the Router Do?

Once the router receives the frame from PC-A, it examines the IP packet.

The router checks its routing information to determine where:

```plaintext
192.168.10.70
```

should be forwarded.

PC-B belongs to:

```plaintext
192.168.10.64/26
```

which is connected to the router's other interface.

The router then forwards the packet toward PC-B.

On the destination subnet, the router may need ARP to determine PC-B's MAC address.

This means ARP is performed locally on each network segment.

The ARP process does not simply travel across the router from PC-A's subnet to PC-B's subnet.

* * *

## Checking PC-B's ARP Table

I also checked the ARP table on PC-B:

```plaintext
arp -a
```

![](https://cdn.hashnode.com/uploads/covers/6a86642ba3057282f8bcdc9d/d738e711-877f-4aa2-b035-c8d48e702bd0.png align="center")

*Caption: PC-B ARP table showing a dynamic ARP entry for its default gateway* `192.168.10.65`*.*

PC-B uses:

```plaintext
192.168.10.65
```

as its default gateway.

Therefore, the ARP table on PC-B can contain a mapping for its local router interface.

This demonstrates that each subnet has its own local ARP process.

* * *

# ARP and the Default Gateway

The relationship between ARP and the default gateway becomes clearer when comparing local and remote communication.

## Destination on the Same Subnet

If the destination is on the same subnet, the host can use ARP to discover the destination host's MAC address.

Conceptually:

```plaintext
Host A
   |
   | ARP
   v
Destination Host
```

The Ethernet frame can then be sent directly to the destination host.

## Destination on a Different Subnet

If the destination is on another subnet, the host does not directly ARP for the remote host's MAC address.

Instead:

```plaintext
Host A
   |
   | ARP
   v
Default Gateway
   |
   | Routing
   v
Remote Network
   |
   v
Destination Host
```

The host needs the MAC address of the local gateway.

The router then performs the Layer 3 forwarding process.

* * *

# ARP vs Routing

ARP and routing are related, but they solve different problems.

| Function | Purpose |
| --- | --- |
| ARP | Resolves an IPv4 address to a MAC address on the local network |
| Routing | Determines where an IP packet should be forwarded |
| MAC address | Used for local Layer 2 delivery |
| IP address | Used for Layer 3 logical addressing |
| Default gateway | Provides a path to other IP networks |

A useful way to remember this is:

```plaintext
ARP:
"Which MAC address belongs to this local IP?"

Routing:
"Where should this IP packet go next?"
```

Understanding this distinction makes network troubleshooting much easier.

* * *

# Common ARP Troubleshooting

ARP problems can cause communication failures even when the IP configuration appears correct.

Some common things to check are:

### 1\. Check the IP Configuration

On a Packet Tracer PC:

```plaintext
ipconfig
```

Verify:

*   IPv4 address
    
*   subnet mask
    
*   default gateway
    

### 2\. Check the ARP Table

Use:

```plaintext
arp -a
```

Look for the expected local IP-to-MAC mapping.

### 3\. Test the Default Gateway

For PC-A:

```plaintext
ping 192.168.10.1
```

For PC-B:

```plaintext
ping 192.168.10.65
```

If the local gateway cannot be reached, investigate the local network before troubleshooting the remote destination.

### 4\. Check the Subnet Mask

A wrong subnet mask can change how a host determines whether a destination is local or remote.

For example:

```plaintext
255.255.255.192
```

is `/26`, while:

```plaintext
255.255.255.0
```

is `/24`.

Using the wrong mask can cause a host to make an incorrect local-versus-remote decision.

* * *

# What I Learned from This Lab

This practical experiment helped me understand several important concepts.

First, ARP does not simply mean:

```plaintext
IP address → MAC address
```

The host first determines whether the destination is local or remote.

If the destination is remote, the host uses ARP to resolve the MAC address of the default gateway.

Second, the IP packet and Ethernet frame have different addressing information.

For communication from PC-A to PC-B:

```plaintext
Destination IP:
192.168.10.70
```

while the local Ethernet destination is the router's MAC address.

Third, ARP is local to a network segment.

The router separates the two subnets, so the ARP process on PC-A's network is different from the ARP process on PC-B's network.

Finally, subnetting directly affects ARP behavior because the subnet mask determines whether a destination is considered local or remote.

* * *

# Conclusion

ARP is a fundamental protocol in IPv4 Ethernet networks because devices need MAC addresses for local Layer 2 communication.

The basic process is:

```plaintext
IPv4 destination
      ↓
Determine local or remote
      ↓
If local → ARP for destination MAC
      ↓
If remote → ARP for default gateway MAC
      ↓
Send Ethernet frame
      ↓
Router forwards the IP packet
```

In the Packet Tracer lab, PC-A successfully communicated with PC-B even though PC-A's ARP table did not contain PC-B's MAC address.

This happened because PC-B was located on a different `/26` subnet.

PC-A therefore used its default gateway:

```plaintext
192.168.10.1
```

rather than trying to resolve PC-B's MAC address directly.

This is a small but important detail that helps explain how **ARP, Ethernet, IP addressing, subnetting, default gateways, and routing work together**.

* * *

# Frequently Asked Questions

## What is ARP?

ARP (Address Resolution Protocol) is used in IPv4 networks to resolve an IP address to a MAC address on the local network.

## Does ARP work across routers?

No. ARP is used on the local network segment. Routers separate broadcast domains, so ARP requests are not forwarded as normal Layer 2 broadcasts across a router.

## Does a host ARP for a remote host's MAC address?

Normally, no. If the destination is on another subnet, the host ARPs for the MAC address of its default gateway.

## What is the difference between ARP and routing?

ARP resolves an IPv4 address to a MAC address for local Layer 2 delivery. Routing determines where an IP packet should be forwarded between networks.

## Why does PC-A have the router's MAC address in its ARP table?

Because PC-A needs the router's local MAC address to send Ethernet frames toward destinations located on other IP networks.

## Why is PC-B's IP address not in PC-A's ARP table?

Because PC-B is on a different `/26` subnet. PC-A sends the packet to its default gateway instead of directly resolving PC-B's MAC address.

* * *

# Final Takeaway

The most important concept from this lab is:

> **ARP resolves local IPv4 addresses to MAC addresses, while routing determines how packets move between IP networks.**

Once this distinction is clear, the relationship between **IP addresses, MAC addresses, ARP, switches, routers, subnet masks, and default gateways** becomes much easier to understand.

* * *

## Next Article

In the next article, I will continue exploring networking fundamentals by looking more closely at **MAC addresses and Ethernet frames**, including how switches use MAC address tables to decide where Ethernet frames should be forwarded.