All lessons are free · No login · No trackingStart learning
uohk.comNetwork Buddies 中

Network Stories 3 · Beginner

Who Is 192.168.1.11? ARP (Address Resolution Protocol)

If you only know someone's IP Address, how do you find their MAC Address?

Starring: Mac, Octo, PipAbout 10 min read

ARPIP AddressMAC AddressBroadcast

Recommended first: Lesson 4, Story 1: “Switch Basics”

1. The Story

Press "Next" to go through it step by step. In each step, a character appears and explains what they are doing.

Prologue: A Quick Review

Step 1 of 12

Every device has two addresses

I have two addresses: my MAC Address (hardware address) is the name tag sewn on me at the factory; my IP Address (network address) is my address on this network, like a postal address.

Animation text version (all steps)
  1. Prologue: A Quick Review
  2. Every device has two addresses · Mac: I have two addresses: my MAC Address (hardware address) is the name tag sewn on me at the factory; my IP Address (network address) is my address on this network, like a postal address.
    • Mac: 192.168.1.10 MAC 00:00:5E:00:53:01
    • TV: 192.168.1.11 MAC 00:00:5E:00:53:02
    • Desktop computer: 192.168.1.12 MAC 00:00:5E:00:53:04
  3. Octo only reads name tags · Octo: Inside a LAN (Local Area Network), I only deliver by the MAC Address on the Frame. The recipient field must have a MAC Address. If you write an IP Address, I can't read it!
  4. Act 1: Only the IP Address Is Known
  5. Mac wants to cast a photo · Mac: I want to cast a photo to the TV. The casting app only tells me: "Send it to 192.168.1.11." But what's the MAC Address of 192.168.1.11? I don't know!
  6. First, check the ARP Cache · Mac: First I flip through my little notebook, called the ARP Cache, to see whether I noted down the answer before. Too bad, the notebook is empty.
    • Mac's ARP Cache: (empty)
  7. A big shout: ARP Request · Pip: Mac sends me off. My backpack says the recipient is FF:FF:FF:FF:FF:FF, and the letter asks: "Who is 192.168.1.11? Please tell 192.168.1.10." This is called an ARP Request. Backpack on, let's go!
    • ARP stands for Address Resolution Protocol
    • The recipient is a Broadcast, because Mac doesn't know the other side's MAC Address yet
  8. Octo sends the Broadcast to everyone · Octo: The recipient is a Broadcast, so by the rules I copy it and send it out of every Port except P1. And I note down while I'm at it: Mac is on P1!
    • Octo's MAC Address Table: P1 → …:01 (Mac)
  9. Not asking me, so I'll ignore it · Pip: The desktop computer opens the letter: it's asking about 192.168.1.11, but the desktop is 192.168.1.12. It's none of its business, so it throws the letter away and doesn't reply.
  10. The TV raises its hand: ARP Reply · Pip: The TV sees the question is about itself! It replies: "192.168.1.11 is me, and my MAC Address is 00:00:5E:00:53:02." This is called an ARP Reply, and it goes to Mac alone.
    • The ARP Reply is a Unicast, because the TV already knows Mac's MAC Address from the Request
    • The TV also saves Mac in its own ARP Cache while it's at it
    • Octo learns something else: P3 → …:02 (TV)
  11. Saved in the ARP Cache · Mac: Got it! I save the answer in my ARP Cache. If I send something to the TV again soon, I won't need to shout.
    • Mac's ARP Cache:
    • 192.168.1.11 → 00:00:5E:00:53:02
    • Entries are kept only for a while (tens of seconds to a few minutes, depending on the operating system)
  12. Act 2: The Real Photo Sets Off
  13. Recipient filled in, let's go! · Pip: Now my backpack is complete: recipient MAC 00:00:5E:00:53:02, and inside, the IP recipient is 192.168.1.11. Octo checks his notebook and sends me straight to P3!
    • Frame recipient: 00:00:5E:00:53:02 (MAC)
    • Packet recipient: 192.168.1.11 (IP)
    • Octo only looks at the MAC and sends it to P3; the desktop computer isn't disturbed at all
  14. What if the other side is on the Internet? · Mac: An ARP Broadcast only travels inside this LAN. If I want to send to 192.0.2.80 on the Internet, I don't ask for its MAC. Instead, I ask for the MAC Address of the home Router, 192.168.1.1, and hand the data to it.
    • An address starting with 192 isn't necessarily a Private IP: only 192.168 addresses are; 192.0.2.80 is a server on the Internet
    • Details: Story 9, "Out the Front Door: Router and Default Gateway"
  15. Summary: ask for the name tag, then deliver · Octo: Remember the three steps: an ARP Request uses a Broadcast to ask "Who has this IP?"; an ARP Reply uses a Unicast to answer "It's me, here's my MAC"; the answer is saved in the ARP Cache. After that, I can deliver accurately!

2. Where Is the Problem

Every device has two addresses:

Address Analogy Who uses it
MAC Address (hardware address) A name tag sewn on at the factory Octo, the Switch, to deliver Frames inside a LAN (Local Area Network)
IP Address (network address) A postal address Apps and Routers, to find the destination

Apps and users usually only know the IP Address. For example, a screen-casting app just says: "Send it to 192.168.1.11."

But inside a LAN, Octo only delivers by the MAC Address on the Frame. If the recipient field is empty, Pip cannot even leave the house.

So first, Mac needs to find out: what is the MAC Address of 192.168.1.11?

3. How the Network Solves It

It is like shouting in a classroom: "Who is Alex Chan? Please raise your hand!" The whole class hears it, but only Alex Chan raises a hand and answers.

ARP (Address Resolution Protocol) does exactly that: it uses a Broadcast (a message sent to everyone) to ask the whole LAN "Who has this IP Address?", and the owner replies with a Unicast (a message sent to just one device) containing its MAC Address.

The answer is saved in the ARP Cache (a short-term memory of answers), so there is no need to ask again for a while.

4. A Closer Look

The Three Devices in the Story

Device IP Address MAC Address Plugged into Octo's
Mac 192.168.1.10 00:00:5E:00:53:01 P1
Desktop computer 192.168.1.12 00:00:5E:00:53:04 P2
TV 192.168.1.11 00:00:5E:00:53:02 P3

ARP Request and ARP Reply

ARP messages go straight inside an Ethernet Frame; they do not need an IP Address wrapping. The two kinds of message look roughly like this:

Field ARP Request (Mac → everyone) ARP Reply (TV → Mac)
Frame recipient MAC FF:FF:FF:FF:FF:FF (Broadcast) 00:00:5E:00:53:01 (Unicast)
Frame sender MAC 00:00:5E:00:53:01 00:00:5E:00:53:02
Type 1 = Request 2 = Reply
Sender IP 192.168.1.10 192.168.1.11
Sender MAC 00:00:5E:00:53:01 00:00:5E:00:53:02
Target IP 192.168.1.11 192.168.1.10
Target MAC 00:00:00:00:00:00 (unknown, filled with zeros for now) 00:00:5E:00:53:01

Notice two things:

  • The Request already contains Mac's IP and MAC, so the TV does not need to ask anything and can reply directly with a Unicast.
  • When the TV receives the Request, it also saves Mac in its own ARP Cache while it is at it.

What Does Octo Do Along the Way?

Octo does not understand ARP, and does not need to. He just does his usual job:

  1. The ARP Request's recipient is the Broadcast Address → Flooding: send it out of every Port except P1; at the same time, learn "Mac is on P1".
  2. The ARP Reply's recipient is Mac → the table says Mac is on P1 → Forwarding: send it only to P1; at the same time, learn "the TV is on P3".

So once ARP is done, both Mac and Octo "know" the TV.

The ARP Cache Is Only Temporary

Entries in the ARP Cache are kept only for a while, anywhere from tens of seconds to a few minutes, depending on the operating system. Once an entry expires, the device asks again the next time it needs to send data.

It is designed this way because IP Addresses can change. For example, after the TV restarts, it may get a different IP Address from DHCP (Dynamic Host Configuration Protocol); if an old answer is kept too long, data could go to the wrong device.

If the Other Side Is on the Internet, Ask the Router

An ARP Broadcast only travels within the same LAN. It does not pass through a Router.

Suppose Mac wants to connect to the example.com server at 192.0.2.80. A small reminder: an address starting with 192 is not necessarily a Private IP; only addresses starting with 192.168 are. 192.0.2.80 is a server on the Internet.

Mac first compares IP Addresses:

  • 192.168.1.11 is inside his own network 192.168.1.0/24 → use ARP to ask for it directly.
  • 192.0.2.80 is not inside his own network → use ARP to ask for the MAC Address (00:00:5E:00:53:FE) of the Default Gateway 192.168.1.1, and hand the Frame to the home Router.

How it then leaves the house is explained in detail in Story 9.

ARP Is Only for IPv4

IPv6 has no ARP, and no Broadcast either. It uses Neighbor Discovery to do the same job, by sending the question to a small group of relevant devices instead of the whole LAN.

5. Try It Yourself

Task: Peek at Your Computer's ARP Cache

  1. On Windows, open "Command Prompt"; on macOS, open "Terminal".
  2. Type arp -a and press Enter.
  3. You will see a table matching IP Addresses to MAC Addresses. On Windows, the result looks roughly like this (the MAC Addresses use "-" as a separator and lower case, but mean the same thing):
Interface: 192.168.1.10 --- 0x5
  Internet Address      Physical Address      Type
  192.168.1.1           00-00-5e-00-53-fe     dynamic
  192.168.1.11          00-00-5e-00-53-02     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static
  1. Look for your home Router's IP Address (it usually ends in .1). It is almost certainly in the table. Think about it: why? (Hint: every time you go online, your data goes out through it.)

Phones usually do not let you view the ARP Cache directly, so you need a computer for this task.

Mini game

Put ARP in the Right Order

Mac is sending data to the TV (192.168.1.11) for the first time. Put the five steps below in the right order.

  1. Mac sends an ARP Request as a Broadcast: "Who is 192.168.1.11?"
  2. Mac sends the photo using the TV's MAC Address
  3. Mac checks his ARP Cache and finds no entry
  4. Mac saves the answer in his ARP Cache
  5. The TV replies with an ARP Reply as a Unicast: "It's me, 00:00:5E:00:53:02"

6. Where the Analogy Breaks

  • It is not a whole class "hearing" it and then thinking. When a device's network interface receives a Broadcast, the operating system just compares the IP Address and immediately drops it if it is not its own. The whole thing takes a tiny amount of time.
  • ARP does not check whether anyone is lying. Any device can reply "It's me!", and ARP will not verify it. Some people abuse this to pretend to be someone else; this is called ARP Spoofing, which is why company networks add extra protection.
  • The little notebook is not permanent. A real ARP Cache expires automatically, and is tidied up regularly, just like a Switch's MAC Address Table.
  • Mac does not "shout" every time. As long as the answer is in the ARP Cache, Mac sends the data straight away without sending another ARP Request.
  • A photo does not fit in one Pip. In the animation, one Pip stands for the whole photo; in real life, a photo is cut into many Frames, and every Frame uses the same ARP answer.

7. Quiz

Question 1 of 3Mac wants to find the MAC Address of 192.168.1.11. What is the recipient MAC Address of the ARP Request Frame?
Question 2 of 3How is the ARP Reply sent back to Mac?
Question 3 of 3Mac wants to send data to 192.0.2.80 on the Internet. Whose MAC Address will he ask for with ARP?

8. Key Notes

  • To send a Frame inside a LAN, you must know the recipient's MAC Address; ARP (Address Resolution Protocol) finds the MAC Address from an IP Address.
  • An ARP Request uses a Broadcast to ask "Who has this IP?"; an ARP Reply uses a Unicast to answer "It's me, here's my MAC".
  • The answer is kept for a while in the ARP Cache, and has to be asked for again once it expires.
  • When the other side is not on the same network, ARP asks for the MAC Address of the Default Gateway (the Router).
  • ARP is only used with IPv4; IPv6 uses Neighbor Discovery.

Further reading

Mac has learned to ask for the name tag first and then deliver, so Octo can now get the photo to the TV accurately. But the phone at home has no network socket at all. How does it join this LAN? In the next story, we meet the invisible cable: Wi-Fi and Access Points.

Related stories