Think about walking into a busy classroom and shouting, "Who is Alex Carter?" You know the person by their logical legal name, but you need to visually identify the physical human in the room so you can hand them a notebook. Once Alex raises their hand, your brain memorizes where they are sitting. For the rest of the day, whenever you need to hand Alex a piece of paper, you walk straight to their desk without shouting across the room again.
In computer networking, your operating system and web applications know destination devices by their logical IPv4 addresses (such as 192.168.1.20). However, down on the physical silicon and copper wire, network interface cards cannot process raw IP addresses. Hardware transceivers only recognize physical 48-bit serial numbers burned into their chips. To bridge this divide between Layer 3 software logic and Layer 2 hardware reality, networks rely on the Address Resolution Protocol (ARP).
Anatomy of a MAC Address
Every physical network card manufactured on earth possesses a unique Media Access Control (MAC) Address. Unlike an IP address that can be reassigned or changed when you move between Wi-Fi networks, a MAC address is permanently burned into the card Read-Only Memory (ROM), which is why engineers often refer to it as a hardware address or burned-in address (BIA).
A MAC address consists of 48 binary bits, formatted for humans as 12 hexadecimal digits grouped into pairs, such as 00:1B:44:11:22:33:
- Organizationally Unique Identifier (OUI): The first 24 bits (first three pairs, e.g.,
00:1B:44) are globally registered and assigned by the IEEE to the hardware manufacturer (such as Intel, Cisco, or Apple). - Device Identifier: The remaining 24 bits (last three pairs, e.g.,
11:22:33) act as an internal production serial number unique to that specific silicon board.
| Comparison Attribute | Layer 2: MAC Address | Layer 3: IPv4 Address |
|---|---|---|
| Addressing Scope | Physical & Local (Link Layer) | Logical & Global (Network Layer) |
| Bit Length & Format | 48 bits (6 Hexadecimal octets) | 32 bits (4 Decimal octets) |
| Persistence | Burned into hardware chip (Permanent) | Configured dynamically or statically |
| Forwarding Device | Ethernet Switch (Layer 2) | IP Router (Layer 3) |
The Two-Step ARP Handshake
When Workstation PC-1 needs to send a packet to PC-2 at 192.168.1.20, it prepares an IPv4 packet. But before its Ethernet chip can transmit the electrical frame onto the copper wire, it must encapsulate that packet inside an Ethernet frame header containing both a Source MAC and a Destination MAC. If PC-1 does not yet know PC-2 hardware MAC, it triggers the ARP process:
- ARP Request (Broadcast): PC-1 places an ARP request frame onto the wire with destination MAC
FF:FF:FF:FF:FF:FF(the universal broadcast address): "Attention everyone on this wire: Who owns IP address 192.168.1.20? Tell 192.168.1.10 at MAC 00:1B:44:11:22:33." Because it is a broadcast, every connected network card picks up and processes the frame. - ARP Reply (Unicast): PC-2 inspects the request, recognizes its own IP address, and sends a direct unicast response back to PC-1 MAC: "I own 192.168.1.20, and my physical MAC address is 00:1B:44:AA:BB:CC."
- ARP Cache Storage: PC-1 receives the reply, extracts the binding, and stores it in RAM inside its ARP Cache Table. All future packets to
192.168.1.20are addressed directly to PC-2 MAC without broadcasting.
Kernel Memory Insight: Dynamic ARP cache entries do not stay in memory forever. Operating systems maintain an aging timer (typically 2 to 20 minutes). If no communication occurs with a host before the timer expires, the entry is flushed to prevent stale hardware mappings if network cards are swapped.
Inspecting Local ARP Cache
You can inspect and monitor your operating system learned address bindings at any time using the arp -a CLI command. In a clean lab before any packets are sent, the ARP table may be completely empty. The moment you execute a ping, ARP executes in milliseconds ahead of the ICMP echo, filling the table with dynamic entries:
Workstation-1:~$ arp -a Interface: 192.168.1.10 --- 0x2 Internet Address Physical Address Type 192.168.1.20 00-1b-44-aa-bb-cc dynamic
Notice the column labeled Type. A dynamic entry means the operating system learned the mapping on the fly by listening to incoming ARP replies. If a network card is replaced or an IP address is reassigned, the operating system will update or expire this row automatically once its timer runs out, avoiding duplicate IP conflicts.
Hands-On ARP Discovery
On your interactive canvas, select PC-1 to view its hardware properties in the inspector drawer. Notice its burned-in MAC address. Next, click PC-2 and note its distinct physical MAC address.
Switch to the PC-1 Terminal tab and run arp -a. Initially, no dynamic entries exist. Now type ping 192.168.1.20. The operating system transparently fires an ARP broadcast, discovers PC-2 MAC address, and stores it in the local cache. Run arp -a once more to see PC-2 physical MAC mapped to its IP address in real-time.