TechKnowSurge
Cisco CCNA 1.13 Cisco CCST Networking 4.5 CompTIA Network+ 1.1 CompTIA Network+ 2.2
TechKnowSurge Catalog Videos ARP Table vs MAC Address Table
VideoNetworkFree

ARP Table vs MAC Address Table

ARP tables and MAC address tables both involve MAC addresses but serve distinct purposes — ARP tables map IP addresses to MAC addresses on end devices, while MAC address tables map port numbers to MAC addresses on switches.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

ARP tables and MAC address tables are easy to confuse because both involve MAC addresses, but they belong to different devices and serve fundamentally different purposes. An ARP table lives on an end device and records the relationship between IP addresses and MAC addresses. When a machine knows a destination's IP address but needs the corresponding Layer 2 address to send an Ethernet frame, it issues an ARP request and stores the result — an IP-to-MAC mapping — in its ARP table for future use. A MAC address table, by contrast, belongs to a switch and records the relationship between MAC addresses and physical switch ports. Switches perform two core functions: learning which MAC address is reachable through which port, and forwarding frames only to the port associated with the destination MAC address. As traffic flows through the switch, it observes the source MAC address of incoming frames and records which port they arrived on, building a port-to-MAC mapping over time. The practical distinction matters for troubleshooting and network design. When a frame destined for a particular MAC address arrives at the switch, the switch consults its MAC address table to determine the correct outbound port and sends the frame there directly, avoiding unnecessary traffic on other segments. Keeping these two tables separate in concept — ARP as an IP-to-MAC reference on hosts, MAC address table as a port-to-MAC reference on switches — is essential for understanding how data moves across a network at Layer 2.

What you'll learn

What's covered

ARP Table vs MAC Address Table

Aligned to

Cisco CCNA
1.13 Describe switching concepts
Cisco CCST Networking
4.5 Explain basic switching concepts
CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
2.2 Given a scenario, configure switching technologies and features.

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
ARP Table
A cache stored on a device that holds mappings of IP addresses to MAC addresses, reducing the need for repetitive ARP broadcasts.
MAC Address Table
A table maintained by a switch (also called the CAM table) that maps source MAC addresses to the switch ports on which those devices were learned. When a frame arrives, the switch looks up the destination MAC in this table to forward it out only the correct port rather than flooding all ports.

Transcript

ARP table versus MAC address table

We've talked about two different types of tables so far, and what I found is there's a bit of memorization that has to happen here. Why? Because a MAC address table sounds like an ARP table. It sounds like they do the same thing, but they serve very different purposes. So I want to make sure that we understand what the difference is between an ARP table and a MAC address table, so we can start memorizing those differences.

The ARP table

When a machine communicates to another machine on a network, it needs to do that using the MAC address, at least when it comes to Ethernet. It knows the IP address, but needs to translate that to a MAC address. So it will do an address resolution protocol to figure out what the layer 2 address is, and then it will record it in an ARP table.

Boy, when we talk about an ARP table, that sure sounds like a MAC address table. After all, we are recording the MAC addresses, the association between IP addresses and MAC addresses. But it's not.

The MAC address table

This MAC address table is already spoken for by the switch. That is, a switch will keep a MAC address table. It keeps the port to MAC address.

Remember, there's two jobs that a switch does. It will learn about the different MAC addresses and what port they're on, and then it will also do the forwarding, so it'll forward it to a single machine. So when this machine replies back to that ARP request, or the first communication that it does, this switch will see that it's coming on port 8, and it will create an association between port 8 and this MAC address. And then what will happen is every time it gets a message that's destined for this MAC address, it will know that it needs to be sent back out port 8. So that's the MAC address table.

This is all to say, don't get confused between the ARP table seen on these end devices with the blue table, and this MAC address table, which is the table on a switch.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →