TechKnowSurge
CompTIA Network+ 1.1 Cisco CCNA 1.13 Cisco CCST Networking 4.5 CompTIA Network+ 1.4 Cisco CCST Cybersecurity 2.1
TechKnowSurge Catalog Videos Address Resolution Protocol (ARP)
VideoNetworkFree

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) is the mechanism that allows networked devices to discover the MAC address associated with a known IP address, enabling communication at the Ethernet layer. Understanding ARP is foundational to how frames are built and delivered across local area networks.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Ethernet networks operate at Layer 2 using MAC addresses to deliver frames between devices, but users and applications typically work with domain names and IP addresses rather than hardware identifiers. This creates a translation problem: before a device can send data across a local network, it must determine the MAC address that corresponds to the destination IP address. Address Resolution Protocol, or ARP, is the standard mechanism that resolves this gap automatically and transparently. When a source device has a destination IP address but no corresponding MAC address, it broadcasts an ARP request onto the local network segment. This request goes out through all switch ports and essentially asks every connected device to identify itself if the IP address belongs to it. The device that owns that IP address responds directly to the requester, providing its MAC address. The source device stores this IP-to-MAC mapping and uses it to populate the destination MAC address field in the outgoing Ethernet frame. Once the frame is properly constructed with both source and destination MAC addresses, the switch forwards it to the correct port based on its MAC address table, and the destination device receives the data. Because the original frame also carries the source MAC address, the destination device can respond without needing to perform its own ARP lookup. This bidirectional awareness is central to how Layer 2 communication functions efficiently, and ARP remains a foundational protocol for anyone working with network infrastructure or cybersecurity.

What you'll learn

What's covered

Address Resolution Protocol (ARP)

Aligned to

CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
1.4 Explain common networking ports, protocols, services, and traffic types.
Cisco CCNA
1.13 Describe switching concepts
Cisco CCST Networking
4.5 Explain basic switching concepts
Cisco CCST Cybersecurity
2.1 Describe TCP/IP protocol vulnerabilities

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Frame
The unit of data used at Layer 2 (Data Link layer) of the OSI model, containing source and destination MAC addresses, a payload (the encapsulated Layer 3 packet), and a frame check sequence for error detection. Frames are how switches and other Layer 2 devices think about and forward data.
Network Interface Card
NIC
A hardware component that connects a computer to a network.

Transcript

Houston, we have a problem. If I'm a machine on a network and I'm trying to communicate to another machine on the network, how in the world am I going to know what the MAC address is? I'm going to communicate to its IP address. But since we're on a layer 2 network, an Ethernet network, I need to be able to send it to its MAC address. So how do I figure that out? Well, the answer to that is the address resolution protocol.

From a domain name down to a MAC address

As we're beginning to see how this is all coming together, we see that as a frame leaves the NIC card, it is heading from some MAC address — some NIC card with a burned-in MAC address — going to some destination MAC address. And so it's going to travel along this way with a destination MAC address of wherever it's trying to go to, and with a source MAC address of where it's coming from.

Now the thing is, we typically in our communication are not typing a bunch of MAC addresses into the machines to make this happen. In fact, what we're probably doing is, if we're going to a website, we're using some sort of domain name. Well, that doesn't quite directly translate to a MAC address. And so what we have to do is we have to translate that domain name into an IP address, and then from an IP address possibly into a MAC address.

So if we are going to this destination right here, to wherever the server is, we're probably typing in something other than the MAC address. And eventually that's going to come up with: this machine has an IP address that's tied to it, and you're somehow getting that IP address and need to communicate to that IP address.

The ARP request and reply

This machine doesn't know what MAC address is associated with that IP address. It needs to find out that information in order to form the frame. So this machine needs to know the destination MAC address of that IP address. And this is all as if it was communicating on a local area network.

And so what it does is it sends out an ARP request, an address resolution protocol. So it sends a request out onto the line and says, who belongs to this IP address? And this machine hears that. What happens is that that request gets sent out all of the ports.

This machine hears that, says yes, that IP address belongs to me. And so what I'm going to do is I'm going to reply to that, to let this machine know that this is the MAC address it needs to communicate to. And so now this device has the IP address, and it knows what MAC address is associated with it, because it did the ARP request and got a reply back.

And now this machine will form that frame with the destination MAC address and put it out on the line. This switch then will forward it onto this server right here, and then this server will get that information.

Now, since this device right here has a source MAC address that it sends across, this machine knows, hey, I need to send it back. So when it replies, it uses the source address of this and the new destination address.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →