Linking IP Addresses to MAC Addresses
IP addresses (like 192.168.1.100) are logical — they are assigned by software and can change. MAC addresses (like 00:1a:2b:3c:4d:5e) are physical — they are burned into network interface cards by manufacturers and identify specific hardware. Switches on your local network operate at the hardware level and only understand MAC addresses.
When your computer wants to send data to IP 192.168.1.5 on the same local network, it knows the destination IP but not the destination MAC address. It cannot send the Ethernet frame without it. This is the problem ARP (Address Resolution Protocol) solves.
The ARP Process:
- ARP Request (Broadcast): Your computer sends a broadcast frame to every device on the local network: "Who has IP
192.168.1.5? TellAA:BB:CC:DD:EE:FF." Every device receives this frame because it is addressed to the broadcast MACFF:FF:FF:FF:FF:FF. - ARP Reply (Unicast): The device that owns
192.168.1.5responds directly to your MAC address: "I have192.168.1.5. My MAC is11:22:33:44:55:66." - ARP Cache: Your computer stores this IP-to-MAC mapping in its ARP cache (also called the ARP table) for a few minutes, avoiding repeated broadcasts for the same destination. Each cached entry also carries a state — reachable and confirmed recently, or stale and due for re-verification.
ARP Spoofing — A Classic Attack
Because ARP has no authentication, any device on the network can send a fake ARP Reply claiming to own any IP address. An attacker can broadcast: "I have 192.168.1.1 (the router's IP), and my MAC is ATTACKER:MAC." Devices that receive this update their ARP caches and begin sending all traffic destined for the router to the attacker instead. This is a Man-in-the-Middle (MitM) attack — the attacker can read, modify, or drop all traffic passing through them.
Defenses include Dynamic ARP Inspection (DAI) on managed switches, which validates ARP packets against a trusted DHCP binding table and drops spoofed replies.
A common interview question is: "What happens when you ping a device on the same subnet for the first time?" The full answer involves ARP: before the ICMP Echo Request can be sent, the OS checks the ARP cache, finds no entry, sends an ARP broadcast to resolve the MAC address, receives the ARP reply, updates the cache, and then sends the ICMP packet. This is why the first ping sometimes shows higher latency than subsequent ones.