192.168.1.2000:00:5e:00:53:20IP · MACARP cacheIP addressMAC address192.168.1.4000:00:5e:00:53:40192.168.1.30? not here192.168.1.3000:00:5e:00:53:30192.168.1.4000:00:5e:00:53:40IP · MAC192.168.1.5000:00:5e:00:53:50IP · MAC192.168.1.3000:00:5e:00:53:30IP · MAC
Envelopes: one Ethernet frame each; ? = ARP request, tag = ARP reply, page = the real packetLaptops: each shows its own IP and MAC addressYellow board: your ARP cache of IP → MAC pairsSwitch: copies broadcasts to every port, sends unicast to oneYour computer (192.168.1.20) has a packet for 192.168.1.30 but needs that computer's MAC address to build the Ethernet frame. Its ARP cache has no row for it, so it broadcasts an ARP request to ff:ff:ff:ff:ff:ff; the switch copies it to every other port. Only the owner of 192.168.1.30 answers, after saving the sender's pair, with a unicast ARP reply. The answer goes into the cache (for a few minutes) and the waiting packet is sent straight to 00:00:5e:00:53:30. The LAN 192.168.1.0/24 is a private range (RFC 1918); the MAC addresses come from the documentation block 00:00:5e:00:53:xx (RFC 9542, which replaced RFC 7042).

The problem

  1. Your computer wants to send a packet to 192.168.1.30 on the same local network. Ethernet delivers frames by MAC address, a fixed hardware address on each network card. Your computer knows the IP, not the MAC.

Ask everyone

Answer and deliver

The frame, field by field

;; step 1/9 · need-mac
;; at You .20
packet waiting:  IPv4 192.168.1.20 → 192.168.1.30
same subnet (192.168.1.0/24), so deliver it directly on the LAN
Ethernet frame needs: dst MAC = ?

Gratuitous ARP: a host can announce its own pair unasked, with its own IP as the target, for example after it starts up or takes over an address. Others update their caches (and may spot an address conflict). Checking for a conflict before using an address is the ARP Probe of RFC 5227. ARP has no authentication: any host can send a reply claiming any IP, and others will believe it. That is ARP spoofing, used to sit in the middle of a conversation; switches defend with features such as Dynamic ARP Inspection.