How ARP works and how a packet leaves the local network

IP addresses identify the final endpoints; MAC addresses only identify the current link.

Model answer. ARP (Address Resolution Protocol) maps an IPv4 address to a MAC address on the local network, because Ethernet and Wi-Fi frames are delivered by MAC address.

Step 1 — Is the destination local?
Host A applies its subnet mask (/24, i.e. 255.255.255.0) to its own and the destination address.

• 192.168.1.20 → network 192.168.1.0, same as A → local delivery.
• 8.8.8.8 → a different network → send via the default gateway (say 192.168.1.1).

Case (a): same subnet

1. A checks its ARP cache for 192.168.1.20.
2. On a miss, it broadcasts an ARP request (destination MAC FF:FF:FF:FF:FF:FF): "Who has 192.168.1.20? Tell 192.168.1.10."
3. Host .20 sends a unicast ARP reply with its MAC address. A caches the mapping for a limited time.
4. A sends the frame: destination MAC = host .20's MAC, destination IP = 192.168.1.20.

Case (b): remote destination

1. A does not ARP for 8.8.8.8 — that host is not on its link.
2. It ARPs for the gateway's IP (192.168.1.1) and learns the router's MAC.
3. The frame has destination MAC = router's MAC, but destination IP = 8.8.8.8.
4. The router strips the frame, looks up 8.8.8.8 in its routing table, and builds a new frame for the next link, ARPing for the next hop if needed.

What changes per hop

• MAC addresses change at every hop — each link has its own source and destination MACs.
• IP source and destination stay the same end to end, except when NAT rewrites them (a home router replaces A's private source IP with its public IP).
• The IP TTL decreases by one at each router.

Extra points

• ARP has no authentication, so attackers can send forged replies (ARP spoofing) to intercept traffic; defences include dynamic ARP inspection on switches.
• A gratuitous ARP is an unsolicited announcement of one's own mapping, used to detect duplicate IPs or update caches after failover.
• IPv6 does not use ARP; it uses Neighbor Discovery Protocol (ICMPv6).

Common mistake: saying A sends an ARP request for 8.8.8.8. ARP never crosses a router.