ARP (Address Resolution Protocol) explained

(Rene Molenaar) #41

This is best explained with the following two captures:

Above you can see the ARP request. The sender (fa:16:3e:38:94:94) creates the ARP request and is looking for It encapsulates this in an Ethernet frame with its own MAC address as the source and destination broadcast.

Everyone on the subnet will hear this message, the device that has the destination MAC address will reply:

Above you can see the ARP reply with the sender MAC and IP address. It’s encapsulated in an Ethernet frame with the source and destination MAC address. The destination MAC address was learned from the ARP request.

Hope this helps.


(alex e) #42

Can I change the storage time of dynamic entries in the table ARP?

(Rene Molenaar) #43

Hi Alex,

Yes you can with the arp timeout command.


(alex e) #44

Thanks to Rene,

And can change the storage time of the dynamic entries entail any any problems. Or time strictly depends on the local network?


(Rene Molenaar) #45

Hi Alex,

This shouldn’t cause any issues unless you set it to a very low value perhaps.


(alex e) #46

Another question rene,
Yet there was a question with more detailed encapsulated in the model OSI. When we carry out ARP request is received from the IP address of the network layer is encapsulated in the data link layer in etnernet frame. then it moves to the physical layer and sent arp request. When the desired PC receives this request, he de-encapsulates the packet to what level? Just before the network layer to check the ip address in the packet with her?
Sorry for my bad English.


(alex e) #47

Thank you Rene, thanks to you, I passed the exam.

(Rene Molenaar) #48

Hi Alex,

Good to hear you passed the exam. When the receiver receives that stream of bits, it will de-encapsulate it just as if were encapsulated. We don’t skip any layers.


(aboubakar b) #49

Hey RM. Can you explain how the switch would be involved in this? If there was a switch where both computers are connected to. Would the switch replicate the ARP request.

(Andrew P) #50

Hi Aboubakar,
Assuming that one computer doesn’t already know the MAC address of the other computer (and they are on the same subnet), then the first computer sends an arp request to FF:FF:FF:FF.FF:FF. The switch knows this addresses is a layer 2 broadcast, so it sends the request out all of its ports except the one where it was originally received.

(Mohammad Hasanuz Zaman) #51

Hi Rene,

ARP, in which layer protocol ?? So far I know , ARP is L2 protocol but it use IP address to resolve the MAC address. Please correct me if any wrong .Thanks


(Andrew P) #52

You have hit upon a question that has caused great confusion. For example, at Cisco’s forum, there are dozens and dozens of posts about in what layer ARP belongs

The problem is that the TCP/IP mode and OSI models don’t line up exactly. Personally, I view ARP as being OSI “layer 2.5” because it performs functions in both 2 and 3 (broadcasts at layer 2 based on information from layer 3). By the way, there are other protocols that are equally as confusing (as far as where they fit in). MPLS is a classic example, where most people say it too functions at “layer 2.5.”

(Muhammad Abid s) #53

sir , for the scenario
Computer A ——-Switch1—–ROUTER1——————ROUTER 2 —- Switch2 —– Computer B.

you said that

"Computer A will do an ARP request for the IP address of Router 1

Computer B will do an ARP request for Router 2 (its default gateway).

Router 1 and Router 2 will do ARP requests on the link that connects them to discover each others MAC addresses."

please rectify/guide me if i am worng
computer A will send ARP request to R1 to know R1 MAC address, so whenever it sends send data to ComputerB it will then send it to MAC address of R1.

sir my second query is that MAC address is required at Local area communication , so why R1 and R1 need to know MAC Address of each other since Router works at L3 (IP).

(Rene Molenaar) #54

Hi Muhammad,

Routers do “routing” on L3 but to actually forward an IP packet, they still have to put it in an Ethernet frame. This means they’ll need to insert a source/destination MAC address.

In the routing table, you will find a next hop IP address for each route that it has. If the next hop is directly connected then it will have to do an ARP to figure out the MAC address of the IP address of the other router.


(Muhammad Abid s) #55

thanks for reply sir ,
please also guide me if i am wrong , is it right ?
computer A will send ARP request to R1 to know R1 MAC address, so whenever it sends send data to ComputerB it will then send it to R1 MAC address.

(Rene Molenaar) #56

That’s correct. ComputerA will have to use its default gateway so it will do an ARP for the IP address of R1.

(Muhammad Abid s) #57

thanks alot sir ,
your video/tutorial is v useful

(Networklessons Admin) split this topic #58

19 posts were merged into an existing topic: ARP (Address Resolution Protocol) explained

(Ashok R) #59


Router A wants to know MAC address of router B. So, it broadcasts ARP. Only router B replies.
In this case, target MAC should be FF:FF:FF:FF:FF:FF which is broadcastin ARP request. Why the target MAC is all 0’s in ARP request?

(Rene Molenaar) #60

Hi Ashok,

Take a look at this capture:

ARP Request and reply

The destination MAC address is FF:FF:FF:FF:FF:FF since it is a broadcast. The target MAC address is what we are looking for and unknown, which is why it is empty (00:00:00:00:00:00).