Networking · 06 · 3 min read

MAC addresses and ARP

IP says where a device is on the map; the MAC address is the name on its network card. ARP connects the two.

MAC address

48 bits written as six pairs of hex digits, like 3C:22:FB:9A:10:7E. The first half identifies the manufacturer. Switches use MAC addresses to deliver frames inside a LAN (layer 2).

How ARP works

  1. 1Your PC wants to reach 192.168.1.1 but doesn’t know its MAC.
  2. 2It shouts to everyone (broadcast): “Who has 192.168.1.1?”
  3. 3Only the router answers: “That’s me, my MAC is …”.
  4. 4Your PC saves the answer in its ARP cache and sends the frame.

Security note

ARP trusts any answer. In ARP spoofing an attacker replies “I’m the router!” and sits in the middle of the traffic. Switches with Dynamic ARP Inspection block this.