Finding a MAC Address With ARP

ARP (Address Resolution Protocol) is how a device on an IPv4 network finds the MAC address that belongs to an IP address on the same link. The device broadcasts a question to every card on the link, and the owner of that IP address answers directly. IPv6 does the same job with a different protocol, neighbour discovery.

The goal. A laptop at 192.168.1.20 wants to send a packet to a printer at 192.168.1.50 on the same office network. It knows the printer's IP address, but a frame needs a destination MAC address, and the laptop does not have it.

What you need. Two devices on one link, and the commands to read a device's ARP cache: ip neigh on Linux, arp -a on macOS and Windows.

The steps.

1. The laptop looks in its ARP cache, a short table of IP addresses and the MAC addresses it has already learned. The printer is not there.
2. It sends an ARP request in a frame addressed to the broadcast MAC ff:ff:ff:ff:ff:ff, so the switch floods it to every port. The request says, in effect, "who has 192.168.1.50? Tell 192.168.1.20", and includes the laptop's own MAC.
3. Every card on the link reads the request. Only the printer owns 192.168.1.50, so only the printer answers.
4. The printer sends an ARP reply addressed to the laptop's MAC alone, not as a broadcast, saying "192.168.1.50 is at 02:00:00:cc:00:05". It also records the laptop's address in its own cache.
5. The laptop stores the answer in its cache and sends the waiting packet in a frame addressed to the printer's MAC.

ip neigh
192.168.1.50 dev eth0 lladdr 02:00:00:cc:00:05 REACHABLE
192.168.1.1 dev eth0 lladdr 02:00:00:bb:00:01 STALE

How you know it worked. The printer's IP address now appears in the cache with a MAC address beside it, and its state is REACHABLE, meaning it was confirmed recently. An entry that shows FAILED or INCOMPLETE means the request went out and nobody answered: the device is off, on another network, or the address is wrong.

Entries do not last forever. After a period of disuse, usually somewhere from seconds to a few minutes, an entry goes stale and is checked again before use, so a device that changes its network card is found again.

One case changes the answer completely. When the destination is on another network, the laptop never asks for the destination's MAC address, because that card is not on its link. It asks for the MAC address of its router instead, the second line in the cache above, and sends the frame there.