ARP: finding the MAC for an IP address

The problem ARP solves

A PC knows the IP address it wants to reach, but the frame needs a destination MAC. ARP (Address Resolution Protocol) finds it:

1. The PC checks its ARP cache. If the MAC is there, it uses it.
2. If not, it broadcasts an ARP request (to ffff.ffff.ffff): "Who has 10.1.1.13? Tell 10.1.1.11."
3. Every device in the LAN reads it; only the owner of 10.1.1.13 answers with a unicast ARP reply: "10.1.1.13 is at 001a.dd6c.939f."
4. Both sides store the pair in their ARP caches (the target learned the sender from the request).

Local or remote?

A PC only ARPs for addresses in its own subnet. For anything else it ARPs for its default gateway and sends the frame to the router's MAC, with the far IP address still inside. The router then ARPs on the next LAN. So the MAC addresses change at every router hop; the IP addresses stay the same end to end.

In NetLab

▶ PC1
NetLab Windows-style command prompt. Type help to see the commands.
C:\Users\student>arp -a

Interface: 10.1.1.11 --- 0xc
  Internet Address      Physical Address      Type
  10.1.1.255            ff-ff-ff-ff-ff-ff     static    
C:\Users\student>ping -n 1 10.1.1.13

Pinging 10.1.1.13 with 32 bytes of data:
Reply from 10.1.1.13: bytes=32 time<1ms TTL=64

Ping statistics for 10.1.1.13:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Users\student>ping -n 1 10.1.1.1

Pinging 10.1.1.1 with 32 bytes of data:
Reply from 10.1.1.1: bytes=32 time<1ms TTL=255

Ping statistics for 10.1.1.1:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Users\student>arp -a

Interface: 10.1.1.11 --- 0xc
  Internet Address      Physical Address      Type
  10.1.1.1              00-1a-62-44-33-62     dynamic   
  10.1.1.13             00-1a-dd-6c-93-9f     dynamic   
  10.1.1.255            ff-ff-ff-ff-ff-ff     static    
▶ R1
R1>enable
R1#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.1.1.1                 -   001a.6244.3362  ARPA   GigabitEthernet0/0
Internet  10.1.1.11                0   001a.33d5.62b1  ARPA   GigabitEthernet0/0

The router shows its own address with age - (it never expires) and PC1's with an age in minutes. On Linux the same table is ip neigh; on macOS it's arp -a.

Why the first ping across a router is lost

When a ping crosses a router for the first time, the router has to ARP for the destination. A Cisco router drops the packet that triggered the ARP instead of holding it, so the first reply never comes: .!!!! on a router, "Request timed out." first on a PC. Every packet after that works. (IPv6 Neighbor Discovery holds the packet instead, so IPv6 pings don't lose one.)

Common mistake: A PC that gets "Destination host unreachable" from its own address sent ARP requests that nobody answered: the target is off, or the PC thinks a remote address is local (wrong mask).