ARP and MAC Addresses: Finding the Hardware
How a host finds the MAC behind an IP, why ARP never leaves the local network, and how a stale cache entry produces a confusing partial outage.
Every explanation of routing assumes the frame can actually be addressed to something on the wire. ARP is the step that makes that true. It sits underneath IP, it never leaves the local network, and when it goes wrong the symptoms look nothing like a naming or routing problem.
Two Kinds of Address
A MAC address identifies a network interface on a local segment. It is assigned to the hardware and it is what a switch uses to decide which port to send a frame out of.
An IP address identifies a host in a logical network and is what routing operates on. It can move between machines, be assigned by a server, or change with the network the device is attached to.
A frame on the wire is addressed to a MAC. A packet inside it is addressed to an IP. Something has to connect the two, and on IPv4 networks that something is ARP.
How the Lookup Works
A host wanting to send to an IP address on its own subnet checks its cache. If there is no entry, it broadcasts a request to the whole segment: which hardware address owns this IP?
Every device on the segment receives the broadcast. The one holding that address replies directly with its MAC. The requester stores the answer and sends the frame.
The reply is accepted on its word. There is no verification and no authority consulted, which is both why ARP is simple and why it can be abused.
Off-Subnet Traffic
A host sending to an address outside its own subnet does not ARP for the destination. It cannot: the destination is not on the local segment and would never hear the broadcast.
Instead it ARPs for its default gateway, and sends the frame to the gateway’s MAC with the remote IP still in the packet header. The router receives the frame, looks at the IP, decides where it goes next, and repeats the same process on the next network along.
This is the detail that explains a common confusion. The MAC address in a frame changes at every hop; the IP addresses do not. See how routing works for what the router does between those two steps.
The Cache
Caching the results avoids a broadcast for every packet. Entries hold for a short period and then expire, which is what lets the network adapt when hardware changes.
| Situation | What the cache does | Symptom |
|---|---|---|
| Normal operation | Entry learned, reused, expires | None |
| Device replaced, same IP | Old MAC cached until it ages out | That one address unreachable, briefly |
| Failover to standby hardware | Old MAC cached unless a gratuitous ARP is sent | Outage until the cache updates |
| Two devices with the same IP | Entry flaps between MACs | Intermittent, confusing connectivity |
| Spoofing | Entry points at an attacker | Traffic silently redirected |
A gratuitous ARP is an unsolicited announcement a device sends to say it now holds an address. It exists so that failovers and hardware changes update everyone’s cache immediately rather than waiting for entries to expire.
Reading the Table
The arp command lists what a machine has learned. Each line gives an IP, the MAC it maps to, and whether the entry was learned dynamically or configured statically.
Two things are worth looking for. A mapping that does not match the hardware you expect indicates either a device swap or something answering for an address it should not. And two IP addresses sharing one MAC is normal on a router but suspicious elsewhere.
Clearing a specific entry forces a fresh lookup, which is the quickest way to test whether a stale cache is the cause of an unreachable device.
The Duplicate Address Problem
Two devices configured with the same IP on one segment both answer ARP requests for it. Different hosts cache different answers depending on which reply arrived last, and connectivity becomes intermittent in a way that is hard to attribute.
The usual cause is a static address assigned inside a DHCP range that the server later hands out to another device. Reserving addresses in the server rather than configuring them on the client avoids it entirely; see DHCP explained.
ARP Spoofing
Because a reply is accepted without verification, a device can answer for an address it does not own. Hosts cache the false mapping and send traffic for that address to the attacker.
Done against the default gateway’s address, this puts the attacker in the path of everything leaving the subnet. It requires access to the local segment, which is why it belongs to the category of attacks that start with someone already on the network.
Switch features that track which MAC and IP belong on which port and drop ARP replies that contradict them are the practical defence. Encryption in transit limits what an attacker in the path can do with what they see.
What People Get Wrong About This
The first mistake is looking for ARP problems on traffic leaving the network. ARP never crosses a router, so a problem reaching a remote service is not an ARP problem.
The second is missing a stale cache entry after replacing hardware. The device is configured correctly, it is on the network, and one specific machine cannot reach it because it is still sending to the old MAC.
A third is assigning static addresses inside a DHCP pool. The conflict appears days later when the server hands the address out.
A fourth is blocking ARP with a firewall rule intended to reduce broadcast traffic. Nothing on the segment can then find anything else.
And the last is treating ARP as a security boundary. It has no authentication at all, and anything relying on the mapping being truthful is relying on nobody being on the segment.
IPv6
IPv6 does not use ARP. The equivalent function is handled by Neighbour Discovery, which uses ICMPv6 messages rather than broadcasts and includes mechanisms ARP lacks, including a form of duplicate address detection.
The concept is the same: an address in the packet has to be resolved to hardware on the wire before the frame can be sent.
Common questions
What does ARP do?
It translates an IP address into the MAC address of the device holding it, on the local network. A host that wants to send to an IP on its own subnet broadcasts a request asking who owns that address, and the owner replies with its MAC. Without that step the frame cannot be addressed at all.
Does ARP work across the internet?
No. ARP is local to a broadcast domain. To reach an address outside the local subnet, a host does not ARP for the destination at all: it ARPs for its default gateway and sends the frame there, and the router repeats the process on the next network along.
What is the ARP cache and why does a stale entry matter?
It stores recently learned IP to MAC mappings so the lookup does not repeat for every packet. Entries expire after a short time. If a device's MAC changes, by hardware replacement or a failover, a cached entry points at hardware that is no longer there, and traffic to that address disappears until the entry ages out.
How do I see the ARP table?
The arp command with the -a switch lists the cached mappings on a machine. Comparing what it shows against the MAC you expect for a device is a quick way to confirm whether the host is talking to the right hardware, or to spot two addresses sharing one MAC.
What is ARP spoofing?
A device answering ARP requests for an address it does not own, so other hosts send traffic intended for that address to the attacker instead. It works because ARP has no authentication: a reply is accepted on its own word. Switch features that validate ARP against known bindings are the usual countermeasure.
Read next
- How DHCP Works: DORA, Leases, and Failure Modes Understand DHCP: the DORA exchange, lease lifecycle, renewal timing, and failure modes like exhausted scopes and conflicting servers.
- DNS Zones Explained: Zone vs Domain, Delegation, SOA Understand DNS zones: what a zone is, how it differs from a domain, delegation, SOA records, zone transfers, and forward/reverse zones.
- DNS over HTTPS: What It Hides and What It Does Not DoH encrypts the query, not the destination. Why it breaks split-horizon DNS and content filtering, and how it differs from DNS over TLS.
- chkdsk, SFC and DISM: Which One to Run and When Three repair tools with three different jobs. Why DISM comes before SFC, what chkdsk actually checks, and when chkdsk can finish off a failing drive.
- Fix 'A required CD/DVD drive device driver is missing' During USB Install When Windows setup says a CD/DVD driver is missing but you're installing from USB, the real cause is usually USB port or media. Learn how to fix it.