4.3.12 · D1Computer Networks

Foundations — ARP — address resolution, ARP cache, gratuitous ARP

2,007 words9 min readBack to topic

Before you can understand a single sentence of the parent note, you need to be fluent in a handful of words and symbols it throws around: IP address, MAC address, frame, broadcast, unicast, LAN / broadcast domain, cache, EtherType, and the two "layers." This page builds each one from nothing, in the order they depend on each other.


1. The two kinds of "address" (the whole reason ARP exists)

Every device on a network has two completely different addresses. This is the single most important idea, so we start here.

The picture below shows both names living on the same laptop at once. Look at how the MAC (red) is stuck to the card while the IP (blue) is a sticker the network hands out.

Figure — ARP — address resolution, ARP cache, gratuitous ARP

Why the topic needs this: ARP is literally defined as the translator between these two. If you don't hold both in your head at once, the phrase "resolve IP → MAC" is meaningless. See Ethernet & MAC addressing and IP addressing & subnetting for the deep dives on each name.


2. The two "layers" (why the names can't talk to each other)

The parent note keeps saying Layer 3 and Layer 2. These are floors in a stack of software, each handing work down to the one below.

A frame is like an envelope; a packet is the letter inside that envelope. When you want to send data, Layer 3 writes the letter (with IP addresses on it) and hands it down to Layer 2, which stuffs it in an envelope and writes MAC addresses on the outside.

Figure — ARP — address resolution, ARP cache, gratuitous ARP

Why the topic needs this: the whole point of ARP is that it sits between these two layers, feeding Layer 2 the MAC that Layer 3 could not supply. (Runs directly over the Ethernet part of Layer 2 — that's why the parent calls it "a Layer-2 protocol.")


3. Frame fields: source, destination, EtherType

Now zoom into that envelope. An Ethernet frame has, on its outside, a few labelled fields. The parent note uses three of them.

The 0x prefix just means "the following digits are hexadecimal (base-16)," a compact way to write raw bytes. 0x0806 is simply the number 2054, but nobody cares about the decimal — it's a fixed label the receiver matches against.

Why the topic needs this: the parent states ARP "runs directly over Ethernet, EtherType 0x0806." Now you know what that string of symbols actually selects.


4. Broadcast vs unicast vs the special MAC FF:FF:FF:FF:FF:FF

ARP's mechanism is "broadcast the question, unicast the answer." These two words describe how many recipients a frame targets.

Figure — ARP — address resolution, ARP cache, gratuitous ARP

Why the topic needs this: "dest MAC = FF:FF:FF:FF:FF:FF" and "unicast reply" are the two lines the parent's step-by-step hangs on.


5. LAN / broadcast domain (the edge of ARP's world)

Picture a room with walls (the router). Shouting fills the room but stops at the walls. ARP is shouting, so ARP only works inside one room.

Why the topic needs this: this is exactly why the parent's biggest "common mistake" is "ARP works across the internet." It doesn't — the walls of the broadcast domain are ARP's world.


6. Cache and timeout (remembering the answer)

Why the topic needs this: the parent's "ARP cache" section, the dynamic-vs-static distinction, and why gratuitous ARP is needed for fast failover all rest on understanding timeout.


Putting the foundations together

MAC address hardware name

IP address logical name

Layer 2 frames

Layer 3 packets

Frame fields src dst EtherType

broadcast vs unicast

broadcast domain LAN

cache and timeout

ARP IP to MAC resolution

Read it top-down: the two names feed the two layers; the layers give you frames with fields; fields give you broadcast vs unicast; frames live inside a broadcast domain; and a cache stores the results — all of it converging on ARP.


Equipment checklist

Cover the right side and test yourself. If any answer is fuzzy, re-read that section before opening the parent note.

What is a MAC address, in one phrase?
A 48-bit hardware name burned into the network card, meaningful only on the local wire.
What is an IPv4 address, in one phrase?
A 32-bit logical, routable name assigned by the network (e.g. 10.0.0.5).
Which layer speaks MAC, and which speaks IP?
Layer 2 (frames) speaks MAC; Layer 3 (packets) speaks IP.
What are the three frame fields ARP cares about?
Destination MAC, Source MAC, and EtherType.
What EtherType value tags an ARP message?
0x0806.
What is the broadcast MAC address and who keeps a broadcast frame?
FF:FF:FF:FF:FF:FF; every card on the LAN keeps it.
Why must an ARP request be a broadcast?
The sender doesn't yet know the target's MAC, so it can't address the frame to one card — it must ask everyone.
What is a broadcast domain and what forms its boundary?
The set of devices that hear each other's broadcasts; a router forms the boundary and does not forward broadcasts.
Why does an ARP cache entry have a timeout?
So stale mappings (e.g. after a NIC swap) eventually expire and get re-learned correctly.

Connections

  • Parent: ARP topic note
  • Ethernet & MAC addressing — the hardware name this page builds on.
  • IP addressing & subnetting — the logical name and the "local vs remote" decision.
  • Default gateway & routing — the "door" you ARP for when the target is remote.
  • Switching & MAC learning tables — how switches use the source MAC of a frame.
  • DHCP — how the IP sticker gets assigned in the first place.
  • NDP — IPv6 Neighbor Discovery — the IPv6 replacement that reuses these same foundations.
  • Network security — MITM & ARP spoofing — what goes wrong because ARP trusts these names blindly.