ARP (Address Resolution Protocol) explained

Sorry for the late reply Rene! thanks!

Why in the ARP request packet do we see 00:00:00:00:00:00 as Target MAC address instead of FF:FF:FF:FF:FF:FF ?

Hi Alias,

Take a look at this wireshark capture:

In the ARP request you can see the destination MAC address is FF:FF:FF:FF:FF:FF which is the broadcast address. The target MAC address is all zeroes, this makes sense since that’s the address we are looking for, it’s unknown.


19 posts were merged into an existing topic: ARP (Address Resolution Protocol) explained

Tell us about the ARP encapsulation OSI

This is best explained with the following two captures:

Above you can see the ARP request. The sender (fa:16:3e:38:94:94) creates the ARP request and is looking for It encapsulates this in an Ethernet frame with its own MAC address as the source and destination broadcast.

Everyone on the subnet will hear this message, the device that has the destination MAC address will reply:


Above you can see the ARP reply with the sender MAC and IP address. It’s encapsulated in an Ethernet frame with the source and destination MAC address. The destination MAC address was learned from the ARP request.

Hope this helps.


1 Like

Can I change the storage time of dynamic entries in the table ARP?

Hi Alex,

Yes you can with the arp timeout command.


Thanks to Rene,

And can change the storage time of the dynamic entries entail any any problems. Or time strictly depends on the local network?


Hi Alex,

This shouldn’t cause any issues unless you set it to a very low value perhaps.


Another question rene,
Yet there was a question with more detailed encapsulated in the model OSI. When we carry out ARP request is received from the IP address of the network layer is encapsulated in the data link layer in etnernet frame. then it moves to the physical layer and sent arp request. When the desired PC receives this request, he de-encapsulates the packet to what level? Just before the network layer to check the ip address in the packet with her?
Sorry for my bad English.


Thank you Rene, thanks to you, I passed the exam.

Hi Alex,

Good to hear you passed the exam. When the receiver receives that stream of bits, it will de-encapsulate it just as if were encapsulated. We don’t skip any layers.


Hey RM. Can you explain how the switch would be involved in this? If there was a switch where both computers are connected to. Would the switch replicate the ARP request.

Hi Aboubakar,
Assuming that one computer doesn’t already know the MAC address of the other computer (and they are on the same subnet), then the first computer sends an arp request to FF:FF:FF:FF.FF:FF. The switch knows this addresses is a layer 2 broadcast, so it sends the request out all of its ports except the one where it was originally received.

Hi Rene,

ARP, in which layer protocol ?? So far I know , ARP is L2 protocol but it use IP address to resolve the MAC address. Please correct me if any wrong .Thanks


You have hit upon a question that has caused great confusion. For example, at Cisco’s forum, there are dozens and dozens of posts about in what layer ARP belongs

The problem is that the TCP/IP mode and OSI models don’t line up exactly. Personally, I view ARP as being OSI “layer 2.5” because it performs functions in both 2 and 3 (broadcasts at layer 2 based on information from layer 3). By the way, there are other protocols that are equally as confusing (as far as where they fit in). MPLS is a classic example, where most people say it too functions at “layer 2.5.”

sir , for the scenario
Computer A ——-Switch1—–ROUTER1——————ROUTER 2 —- Switch2 —– Computer B.

you said that

"Computer A will do an ARP request for the IP address of Router 1

Computer B will do an ARP request for Router 2 (its default gateway).

Router 1 and Router 2 will do ARP requests on the link that connects them to discover each others MAC addresses."

please rectify/guide me if i am worng
computer A will send ARP request to R1 to know R1 MAC address, so whenever it sends send data to ComputerB it will then send it to MAC address of R1.

sir my second query is that MAC address is required at Local area communication , so why R1 and R1 need to know MAC Address of each other since Router works at L3 (IP).

Hi Muhammad,

Routers do “routing” on L3 but to actually forward an IP packet, they still have to put it in an Ethernet frame. This means they’ll need to insert a source/destination MAC address.

In the routing table, you will find a next hop IP address for each route that it has. If the next hop is directly connected then it will have to do an ARP to figure out the MAC address of the IP address of the other router.


thanks for reply sir ,
please also guide me if i am wrong , is it right ?
computer A will send ARP request to R1 to know R1 MAC address, so whenever it sends send data to ComputerB it will then send it to R1 MAC address.