ARP (Address Resolution Protocol) explained

0 vote

If you learned about the OSI Model and encapsulation / decapsulation you know that when two computers on the LAN want to communicate with each other the following will happen:

  • An IP packet is created with a source and destination IP address carrying the data from an application.
  • The IP packet will be encapsulated in an Ethernet frame with a source and destination MAC address.

The sending computer will of course know its source MAC address but how does it know the destination MAC address? That’s where ARP comes into play. Let me show you an example:

Two Computers

In the picture above we have two computers, computer A and computer B and you can see their IP addresses and their MAC addresses.

We are sitting behind computer A, open up a command prompt and type:

Pinging with 32 bytes of data:
Reply from bytes=32 time=15ms TTL=57
Reply from bytes=32 time=15ms TTL=57
Reply from bytes=32 time=14ms TTL=57
Reply from bytes=32 time=17ms TTL=57

Ping statistics for
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 14ms, Maximum = 17ms, Average = 15ms

You know about the OSI-model and also know we have to go through all the layers.

Ping uses the ICMP protocol and IP uses the network layer (layer 3). Our IP packet will have a source IP address of and a destination IP address of Next step will be to put our IP packet in an Ethernet frame where we set our source MAC address AAA and destination MAC address BBB.

Now wait a second…how does computer A know about the MAC address of computer B? We know the IP address because we typed it but there is no way for computer A to know the MAC address of computer B. There is another protocol we have that will solve this problem for us, it’s called ARP (Address Resolution Protocol). Let me show you how it works:

C:UsersComputerA>arp -a

Interface: --- 0xb
  Internet Address      Physical Address      Type           00-0c-29-63-af-d0     dynamic
  192.168.1  .255       ff-ff-ff-ff-ff-ff     static            01-00-5e-00-00-16     static           01-00-5e-00-00-fc     static       01-00-5e-7f-ff-fa     static       ff-ff-ff-ff-ff-ff     static

In the example above you see an example of an ARP table on a Computer A. As you can see there is only one entry, this computer has learned that the IP address has been mapped to the MAC address 00:0C:29:63:AF:D0.

Let’s take a more detailed look at ARP and how it functions:

ARP Request

In this example we have two computers and you can see their IP address and MAC address. We are sitting behind computer A and we want to send a ping to computer B. The ARP table is empty so we have no clue what the MAC address of computer B is. The first thing that will happen is that computer A will send an ARP Request. This message basically says “Who has and what is your MAC address?” Since we don’t know the MAC address we will use the broadcast MAC address for the destination (FF:FF:FF:FF:FF:FF). This message will reach all computers in the network.

ARP Reply


Computer B will reply with a message ARP Reply and is basically saying “that’s me! And this is my MAC address”. Computer A can now add the MAC address to its ARP table and start forwarding data towards computer B.

If you want to see this in action you can look at it in Wireshark:

ARP in Wireshark

Above you see the ARP request for Computer A that is looking for the IP address of Computer B. The source MAC address is the MAC address of computer A, the destination MAC address is “Broadcast” so it will be flooded on the network.

The second packet is the ARP reply. Computer B will send its MAC address to Computer A. Here’s a detailed look:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 438 Lessons. More Lessons Added Every Week!
  • Personal Support by Rene Molenaar (CCIE #41726)




100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Digiprove sealCopyright protected by Digiprove © 2013 Rene Molenaar

Rate this Lesson:

Tags: , , ,

31 Responses to “ARP (Address Resolution Protocol) explained”

  1. Rama July 31, 2013 at 08:59 #


    Why in the ARP reply packet do we see 00:00:00:00:00:00 as Target MAC address instead of FF:FF:FF:FF:FF:FF ?

    • Roger B January 23, 2015 at 01:06 #

      You are confusing two different types of information here. the FFF…represents the broadcast destination address. why? because the request must be sent to everyone since I don’t know which Mac address is attached to the IP.
      The 000… represents the Target MAc yet (unknown)

      I hope this makes sense

  2. Rama July 31, 2013 at 09:00 #

    I meant ARP request

    • Rene Molenaar July 31, 2013 at 09:03 #

      FF:FF:FF:FF:FF:FF in binary is all 1s…in other words, it will be broadcasted within the broadcast domain. This way the ARP request reaches all devices in the broadcast domain.

      • Rama August 1, 2013 at 09:32 #

        I agree with that. That’s why I wonder why we see 00:00:00:00:00:00 is the ARP request screenshot…

      • Jarjarjar Jar December 16, 2014 at 06:03 #

        When we see in ARP request packet in the Target hardware address (THA) field 0000.0000.0000 (instead of FFFF.FFFF.FFFF) maybe it is connected with the older broadcast address standard? I have read in the „TCP/IP Illustrated„ written by Kevin R. Fall and W. Richard Stevens in the “Proxy ARP” chapter that „some used an older broadcast address (a host ID of all 0 bits, instead of the current standard of a host ID with all 1 bits)”. I can’t find more information about this older broadcast address standard. Is my conjecture correct?

        Link to the quoted sentence:

        • Rene Molenaar December 16, 2014 at 11:57 #

          The link with the quote doesn’t work for me but there are two different things when we look at the ARP request:

          – Destination Address
          – Target Hardware Address

          These are two different things…the destination address is found in the layer 2 (Ethernet) header and specifies where to forward the frame to, it’s set to FFFF.FFFF.FFFF (broadcast). The target hardware address is found in the ARP header and since it’s an ARP request, we don’t know the target…it is set to 0000.0000.0000.

          If you capture an ARP request with wireshark then you’ll find both values :)

  3. virender September 9, 2013 at 08:46 #

    May you pls explain same scenario adding 2 switches and 2 routers in between.

    Computer A ——-Switch1—–ROUTER1——————ROUTER 2 —- Switch2 —– Computer B.

    Much Thanks !!

    • Rene Molenaar September 9, 2013 at 18:44 #

      Hi Virender,

      When Computer A wants to reach Computer B it will have to know how to reach its default gateway because both computers are in a different subnet. What happens is that Computer A will do an ARP request for the IP address of Router 1 (its default gateway).

      Computer B will do an ARP request for Router 2 (its default gateway).

      Router 1 and Router 2 will do ARP requests on the link that connects them to discover each others MAC addresses.


  4. reza January 11, 2014 at 19:33 #

    thank you.
    why does a pc need a pc*s mac-address that is in same network?if we know its ip address so we dont need to know its mac-address.
    thank you

    • Rene Molenaar January 14, 2014 at 15:40 #

      Hi Reza,

      IP is a layer 3 protocol and Ethernet is a layer 2 protocol. If you want to send an IP packet on the LAN you have to put it in an Ethernet frame in order to send it. Ethernet frames use MAC addresses for identification.


  5. reza January 14, 2014 at 20:06 #

    thanks Rene

  6. Taran February 7, 2014 at 20:50 #

    Great article Rene.
    Helped alot in understanding ARP.

    Keep up the good work.

  7. Schweta August 24, 2014 at 14:48 #

    Hello Renne,

    Thank you for all this info on Networking put up in a very simple way.

    Could you please explain what is the difference between ARP Table and Routing Table? And what is Reverse ARP?


  8. kiran g November 5, 2014 at 05:28 #

    Hi Rene ,

    why do we see incomplete MAC entries when a device is connected to a CISCO Router through a switch ?

    • Rene Molenaar November 5, 2014 at 14:42 #

      Hi Kiran,

      Which incomplete MAC entries are you referring to? Do you have an example?


      • kiran g November 5, 2014 at 16:42 #

        Hi Rene ,

        I am referring to incomplete MAC entries connected to the router.

        PNTADD01#sh arp
        Protocol Address Age (min) Hardware Addr Type Interface
        Internet – 0000.0c07.ac01 ARPA GigabitEthernet0/0
        Internet – a493.4cbd.3780 ARPA GigabitEthernet0/0
        Internet 0 Incomplete ARPA
        Internet 0 Incomplete ARPA
        Internet 0 Incomplete ARPA
        Internet 0 Incomplete ARPA
        Internet 0 Incomplete ARPA
        Internet 0 Incomplete ARPA

        • Rene Molenaar November 5, 2014 at 18:17 #

          Hi Kiran,

          Ah ok, good question.

          When the router does an ARP request but doesn’t get a ARP reply in return, it will show up as incomplete.

          Try to ping an IP address that isn’t reachable and you’ll see it in this list.


          • kiran g November 6, 2014 at 06:31 #

            Hi Rene ,

            Yes i am not able to ping any of those which shows as incomplete.
            I was not getting an answer from anyone on this and finally i got it from you. Thanks Rene .


  9. Aisha M March 2, 2015 at 15:05 #

    Dear Rene,

    I studied about ARP before but one thing is still not clear about it.

    ARP is located between LLC and IP layers of the protocol stack. When the destination’s MAC address is unknown ARP sends a broadcast ARP request frame.

    Does it send those request frames through its data link and physical layers? When it gets the reply it goes back through physical and data link layers again, right?

    Best regards,

    • Rene Molenaar March 3, 2015 at 09:56 #

      Hi Aisha,

      That’s right. You can never skip any layers in the OSI model…it will always be encapsulated by the data link layer and physcal layer. On the other side, it will be de-encapsulated.


  10. Keith L April 15, 2015 at 22:35 #

    Hello sir, thank you for answering my last question about wireshark. Question, with this example how did you find the person’s (compute B) IP address in the first place?

    • Rene Molenaar April 15, 2015 at 23:06 #

      Hi Keith,

      You are welcome.

      About the IP address…I had to look it up. For example, if I was trying to access a shared folder on another computer then I would have to find out the IP address of the other computer myself. On the Internet, we use DNS to find the IP address behind hostnames.

      Also, some applications might have a method of finding the IP address of devices in the same subnet.

  11. Gabriel S April 28, 2015 at 05:44 #

    Thank you, Rene! Perhaps to be interesting to make an addendum about gratuitous ARP work.


  12. Leonel M August 4, 2015 at 18:33 #

    Great article Rene.
    Helped alot in understanding ARP.

    Keep up the good work.

  13. Vasu S August 26, 2015 at 18:24 #


Leave a Reply