How Does ARP Map IPv4 Addresses to MAC Addresses?

The Address Resolution Protocol (ARP) is a fundamental communication protocol used in classical computing networks to translate 32-bit IPv4 logical addresses into 48-bit physical Media Access Control (MAC) addresses. Because local area networks (LANs) deliver frames at the data link layer using hardware MAC addresses rather than network-layer IP addresses, devices rely on ARP to discover the exact physical destination of a packet before transmitting it over Ethernet or Wi-Fi.

Why IPv4 and MAC Addresses Both Exist

In classical networking, communication is divided into layers. The network layer uses IPv4 addresses (such as 192.168.1.10) to route packets across different networks, while the data link layer uses MAC addresses (such as 00:1A:2B:3C:4D:5E) burned into network interface cards (NICs) to deliver frames within a single local network segment. A device sending data knows the destination IPv4 address, but the local network switch only understands MAC addresses. ARP bridges this gap by dynamically binding the two address types together.

The ARP Resolution Process

When a host wants to send an IPv4 packet to another device on the same local subnet, it follows a four-step request-and-reply sequence:

  1. ARP Cache Lookup: The sending host first checks its local ARP cache (or ARP table) to see if it already has a recent mapping for the target IPv4 address. If a valid entry exists, it uses that MAC address immediately.
  2. ARP Request Broadcast: If no entry is found, the host constructs an ARP Request packet containing its own IPv4 and MAC addresses, along with the target IPv4 address. Because the destination MAC address is unknown, the host wraps this request in a broadcast Ethernet frame using the special MAC address FF:FF:FF:FF:FF:FF, which all devices on the local network segment receive.
  3. Target Processing: Every device on the subnet receives the broadcast and inspects the target IPv4 address. Devices whose IPv4 address does not match simply discard the packet. The device that owns the requested IPv4 address recognizes the match and records the sender's IPv4-to-MAC mapping in its own ARP cache.
  4. ARP Reply Unicast: The target device sends an ARP Reply directly back to the original sender's MAC address (a unicast transmission). This reply contains the target's MAC address. Upon receiving it, the sender updates its ARP cache and begins transmitting the queued IPv4 packets.

The ARP Cache and Timeouts

To avoid flooding the local network with broadcast traffic for every packet, operating systems store resolved mappings in an ARP cache in memory. Each entry is assigned a Time-to-Live (TTL) timer, typically ranging from a few minutes to several hours depending on the operating system. If an entry is not used before its timer expires, it is removed so that hardware changes (such as replacing a network card or reassigning an IP address) do not leave stale mappings in the table.

Special Cases in ARP

  • Default Gateway Resolution: When a host needs to send a packet to an IPv4 address outside its local subnet, it does not use ARP to find the remote server's MAC address. Instead, it uses ARP to resolve the MAC address of its local default gateway (router), which then forwards the packet toward its final destination.
  • Gratuitous ARP: A device can send an unprompted ARP Request for its own IPv4 address. This is used to detect IP address conflicts on the network and to update the ARP caches of other devices if a MAC address changes.
  • Proxy ARP: A router can answer ARP Requests on behalf of another network, allowing devices on one segment to reach another segment without knowing the network is split.