ARP Example: A Laptop Sends Its First Packet to the Router

A laptop just joined Wi-Fi, has an empty ARP cache, and wants to reach a server on the internet.

ARP is easiest to see on the first packet a device sends to the internet, because the device asks for its router's MAC address and not the server's. A laptop that has just joined a café's Wi-Fi has learned nothing yet: its ARP cache is empty, and it wants to open a web page on a server at 203.0.113.10.

When the laptop joined, the network gave it three settings: its own address, 192.168.1.20; the size of the local network, 192.168.1.0 to 192.168.1.255; and its default gateway, the router at 192.168.1.1. The values are illustrative.

The laptop's ARP cache and the first frame's addresses, step by step

InputLaptop 192.168.1.20 with an empty ARP cache, sending a packet to 203.0.113.10

Is the server local?
1. cache: empty
2. next hop: ?
203.0.113.10 is outside 192.168.1.0 to 192.168.1.255, so the packet must go to the gateway.
Look up the gateway
1. cache: empty
2. next hop: 192.168.1.1decided
The laptop needs the MAC address of 192.168.1.1, not of the server, and the cache has nothing.
ARP request, broadcast
1. cache: empty
2. next hop: 192.168.1.1
3. asking: who has 192.168.1.1?sent
Every device on the café's network hears the question.
ARP reply, to the laptop only
1. cache: 192.168.1.1 is 02:00:00:bb:00:01learned
2. next hop: 192.168.1.1
The router answers and the laptop stores the answer.
First frame leaves
1. to MAC 02:00:00:bb:00:01
2. to IP 203.0.113.10
3. from IP 192.168.1.20
The frame goes to the router's card; the packet inside still names the server.

ResultThe frame is addressed to the router, and the packet inside it to the server.

Three things are worth noticing.

The server's MAC address is never asked for. The server is not on the café's link, so no card here could answer. Whatever MAC address the server's network card has, the laptop never learns it.

The decision to use the gateway comes before ARP. The laptop compares the destination with its own network range first. That comparison, covered with subnets, is what turns "send to 203.0.113.10" into "send to 192.168.1.1".

Only the first packet pays. Every later packet to any address on the internet goes to the same router, so the cached entry serves them all until it expires.

← → move through sections and cards