ARP Process in a Routed Network Explained – Frame Flow, MAC Address Resolution & Packet Forwarding (CCNA / CCNP Guide)
Almost every networking student asks the same question: "If the IP address stays the same all the way from source to destination, why do MAC addresses keep changing?"
The answer is ARP (Address Resolution Protocol) combined with routing. The diagram above follows one packet from PC1 (192.168.1.10) to PC2 (192.168.2.20) across two routers and shows exactly when ARP is used, how every Ethernet frame is rebuilt at each hop, and what never changes.
💼 For Professionals: Focus on the "Real-World Notes", the Wireshark capture points, the ARP security section (DAI and DHCP Snooping), and the troubleshooting scenarios.
What You Will Learn
- What ARP is and why it is needed
- How a host decides between local delivery and sending to the default gateway
- The ARP packet structure and how ARP requests and replies work
- A complete 9-step walkthrough of a packet crossing two routers
- Why IP addresses stay the same but MAC addresses change at every hop
- ARP caches, verification commands, and Wireshark filters
- Proxy ARP, Gratuitous ARP, and IPv6 Neighbor Discovery
- ARP attacks (poisoning, spoofing, man-in-the-middle) and how to defend against them
- Troubleshooting scenarios, exam tips, and interview questions
🗺 The Network in the Diagram
PC1 ─── Access Switch ─── R1 ═══ WAN 10.10.10.0/30 ═══ R2 ─── Access Switch ─── PC2
192.168.1.10 LAN: 192.168.1.1 WAN: 10.10.10.2 192.168.2.20
WAN: 10.10.10.1 LAN: 192.168.2.1
Addressing Table
| Device | Interface | IP Address | Network |
|---|---|---|---|
| PC1 | NIC | 192.168.1.10 | 192.168.1.0/24 |
| R1 | LAN | 192.168.1.1 | 192.168.1.0/24 |
| R1 | WAN | 10.10.10.1 | 10.10.10.0/30 |
| R2 | WAN | 10.10.10.2 | 10.10.10.0/30 |
| R2 | LAN | 192.168.2.1 | 192.168.2.0/24 |
| PC2 | NIC | 192.168.2.20 | 192.168.2.0/24 |
Three Separate Broadcast Domains
- Segment 1: PC1 ↔ Switch ↔ R1 LAN (192.168.1.0/24)
- Segment 2: R1 WAN ↔ R2 WAN (10.10.10.0/30, only 2 usable addresses: .1 and .2)
- Segment 3: R2 LAN ↔ Switch ↔ PC2 (192.168.2.0/24)
Routers do not forward broadcasts, so every ARP broadcast stays inside its own segment. That is the reason ARP is needed separately on each segment.
A router has a different MAC address on every interface, so we label them separately. These are made-up example values:
PC1 = 11:11:11:11:11:11 | R1 LAN = AA:AA:AA:AA:AA:AA | R1 WAN = CC:CC:CC:CC:CC:CC
R2 WAN = BB:BB:BB:BB:BB:BB | R2 LAN = DD:DD:DD:DD:DD:DD | PC2 = 22:22:22:22:22:22
📚 What is ARP?
ARP (Address Resolution Protocol) finds the MAC address (Layer 2) that belongs to a known IPv4 address (Layer 3) on the same local network.
Why Do We Need It?
- Applications and routing work with IP addresses
- Ethernet frames are delivered using MAC addresses
- A device must know the destination MAC before it can build the Ethernet frame
IP says: "Send this to 192.168.1.1" Ethernet: "Fine, but what is that device's MAC address?" ARP: "Let me ask the LAN."
Where ARP Fits
- ARP sits between Layer 2 and Layer 3. It is not carried inside an IP packet.
- ARP is encapsulated directly in an Ethernet frame with EtherType 0x0806.
- ARP is limited to the local broadcast domain (it is never routed).
The Golden Rules
| Rule | Meaning |
|---|---|
| 1 | IP addresses are end-to-end. Source and destination IP stay the same across routers. |
| 2 | MAC addresses are hop-by-hop. They are rewritten at every router. |
| 3 | ARP is local only. You ARP for the next hop, never for a remote host. |
| 4 | Routers do not forward broadcasts. ARP requests stop at the router interface. |
| 5 | Switches forward by MAC address. Routers forward by IP address. |
📦 ARP Packet Structure
| Field | ARP Request | ARP Reply |
|---|---|---|
| Hardware Type | 1 (Ethernet) | 1 (Ethernet) |
| Protocol Type | 0x0800 (IPv4) | 0x0800 (IPv4) |
| Hardware / Protocol Size | 6 / 4 | 6 / 4 |
| Opcode | 1 (Request) | 2 (Reply) |
| Sender MAC | PC1 MAC | R1 LAN MAC |
| Sender IP | 192.168.1.10 | 192.168.1.1 |
| Target MAC | 00:00:00:00:00:00 (unknown) | PC1 MAC |
| Target IP | 192.168.1.1 | 192.168.1.10 |
| Ethernet Destination MAC | FF:FF:FF:FF:FF:FF (broadcast) | PC1 MAC (unicast) |
Notice that the ARP request is a broadcast, but the ARP reply is a unicast. The sender's MAC and IP inside the request also let the receiver learn about the sender at the same time.
🔄 Step-by-Step: PC1 Sends a Packet to PC2
Step 1 – PC1 Decides: Local or Remote?
PC1 wants to reach 192.168.2.20. It compares the destination to its own subnet using its subnet mask:
PC1 network: 192.168.1.10 AND 255.255.255.0 = 192.168.1.0 Destination network: 192.168.2.20 AND 255.255.255.0 = 192.168.2.0 192.168.1.0 ≠ 192.168.2.0 → Destination is REMOTE
Because the destination is on a different network, PC1 must send the packet to its default gateway (192.168.1.1).
At this point the IP packet is ready:
Source IP: 192.168.1.10 Destination IP: 192.168.2.20
But PC1 does not yet know the gateway's MAC address, so it checks its ARP cache. If there is no entry, it sends an ARP request.
Step 2 – PC1 Sends an ARP Request (Broadcast)
ARP Message: "Who has 192.168.1.1? Tell 192.168.1.10" Ethernet Frame Source MAC: PC1 MAC (11:11:11:11:11:11) Destination MAC: FF:FF:FF:FF:FF:FF (broadcast) EtherType: 0x0806 (ARP)
What the Switch Does
- The switch learns PC1's MAC address on the port it arrived on (adds it to the MAC address table)
- Because the destination is the broadcast address, the switch floods the frame out of every other port in the VLAN
- Every device in the VLAN receives and processes the ARP request, but only the owner of 192.168.1.1 replies
Step 3 – R1 Sends an ARP Reply (Unicast)
R1's LAN interface owns 192.168.1.1, so it answers directly to PC1:
ARP Message: "192.168.1.1 is at AA:AA:AA:AA:AA:AA" Ethernet Frame Source MAC: AA:AA:AA:AA:AA:AA (R1 LAN) Destination MAC: 11:11:11:11:11:11 (PC1)
- R1 also adds PC1 (192.168.1.10 → 11:11:11:11:11:11) to its own ARP cache
- The switch learns R1's MAC on the R1 port, then forwards the unicast reply only to PC1's port
- PC1 stores 192.168.1.1 → AA:AA:AA:AA:AA:AA in its ARP cache
Step 4 – PC1 Sends the Data Frame to the Router
Now PC1 has everything it needs to build the frame:
| Layer | Field | Value |
|---|---|---|
| Layer 2 (Ethernet) | Source MAC | PC1 (11:11:11:11:11:11) |
| Layer 2 (Ethernet) | Destination MAC | R1 LAN (AA:AA:AA:AA:AA:AA) |
| Layer 3 (IP) | Source IP | 192.168.1.10 |
| Layer 3 (IP) | Destination IP | 192.168.2.20 |
Step 5 – R1 Makes the Routing Decision
R1 receives the frame, sees its own MAC as the destination, and processes it:
1. Check the frame's destination MAC - it matches R1's LAN interface 2. Remove (de-encapsulate) the Ethernet header and trailer 3. Read the destination IP: 192.168.2.20 4. Look up the routing table 5. Decrease the TTL by 1 and recalculate the IP header checksum 6. Choose the outgoing interface and next hop
R1 Routing Table (Example)
| Network | Next Hop | Exit Interface |
|---|---|---|
| 192.168.1.0/24 | Directly connected | LAN interface |
| 10.10.10.0/30 | Directly connected | WAN interface |
| 192.168.2.0/24 | 10.10.10.2 | WAN interface |
The longest matching route for 192.168.2.20 is 192.168.2.0/24 via 10.10.10.2. The next hop is R2's WAN address.
Step 6 – R1 Uses ARP to Find the Next Hop
R1 knows the next-hop IP (10.10.10.2) but not its MAC address. It sends another ARP request, this time on the WAN segment:
R1: "Who has 10.10.10.2? Tell 10.10.10.1" (broadcast on WAN link) R2: "10.10.10.2 is at BB:BB:BB:BB:BB:BB" (unicast reply)
R1 stores 10.10.10.2 → BB:BB:BB:BB:BB:BB in its ARP cache.
Step 7 – R1 Builds a New Frame and Forwards It
R1 now creates a brand-new Ethernet frame for the WAN segment:
| Layer | Field | Value |
|---|---|---|
| Layer 2 (new) | Source MAC | R1 WAN (CC:CC:CC:CC:CC:CC) |
| Layer 2 (new) | Destination MAC | R2 WAN (BB:BB:BB:BB:BB:BB) |
| Layer 3 | Source IP | 192.168.1.10 (unchanged) |
| Layer 3 | Destination IP | 192.168.2.20 (unchanged) |
Step 8 – R2 Receives the Frame and ARPs for PC2
R2 receives the frame, removes the Ethernet header, checks its routing table, and finds that 192.168.2.20 is on a directly connected network (192.168.2.0/24). R2 now needs PC2's MAC address:
R2: "Who has 192.168.2.20? Tell 192.168.2.1" (broadcast on LAN 2) PC2: "192.168.2.20 is at 22:22:22:22:22:22" (unicast reply)
R2 stores 192.168.2.20 → 22:22:22:22:22:22 in its ARP cache. (Only the first packet needs this resolution. After that, the ARP cache is used.)
Step 9 – Final Delivery to PC2
| Layer | Field | Value |
|---|---|---|
| Layer 2 (new) | Source MAC | R2 LAN (DD:DD:DD:DD:DD:DD) |
| Layer 2 (new) | Destination MAC | PC2 (22:22:22:22:22:22) |
| Layer 3 | Source IP | 192.168.1.10 (unchanged) |
| Layer 3 | Destination IP | 192.168.2.20 (unchanged) |
PC2 sees its own MAC address, accepts the frame, removes the Ethernet header, finds its own IP in the packet, and passes the data to the upper layers. Packet delivered successfully ✅
🎬 Whole Journey at a Glance
PC1 R1 R2 PC2 │ │ │ │ │── ARP Request ───►│ (who has .1.1?) │ │ │◄─ ARP Reply ──────│ │ │ │ │ │ │ │── Frame 1 ───────►│ │ │ │ (PC1 → R1 LAN) │ │ │ │ │── ARP Request ────►│ (who has 10.10.10.2?) │ │◄─ ARP Reply ───────│ │ │ │ │ │ │ │── Frame 2 ────────►│ │ │ │ (R1 WAN → R2 WAN) │ │ │ │ │── ARP Request ────►│ (who has .2.20?) │ │ │◄─ ARP Reply ───────│ │ │ │ │ │ │ │── Frame 3 ────────►│ │ │ │ (R2 LAN → PC2) │
🔁 What Changes and What Never Changes
MAC Address Changes Table
| Hop | Path | Source MAC | Destination MAC |
|---|---|---|---|
| Hop 1 | PC1 → R1 | PC1 (11:11:...) | R1 LAN (AA:AA:...) |
| Hop 2 | R1 → R2 | R1 WAN (CC:CC:...) | R2 WAN (BB:BB:...) |
| Hop 3 | R2 → PC2 | R2 LAN (DD:DD:...) | PC2 (22:22:...) |
IP Address Table
| Hop | Source IP | Destination IP |
|---|---|---|
| Hop 1 | 192.168.1.10 | 192.168.2.20 |
| Hop 2 | 192.168.1.10 | 192.168.2.20 |
| Hop 3 | 192.168.1.10 | 192.168.2.20 |
Complete Comparison
| Item | Changes at Each Router? | Why |
|---|---|---|
| Source IP / Destination IP | ❌ No | Identify the original sender and final receiver (end-to-end) |
| Source MAC / Destination MAC | ✅ Yes | Only valid on one Layer 2 segment (hop-by-hop) |
| Ethernet FCS (trailer) | ✅ Yes | Recalculated because the frame is new |
| IP TTL | ✅ Decreases by 1 | Prevents endless routing loops |
| IP Header Checksum | ✅ Recalculated | TTL changed |
| Upper-layer data (TCP / UDP / payload) | ❌ No | Routers do not touch it (unless NAT / inspection is applied) |
🧠 OSI Model Explanation
| Layer | Role in This Process | Changes at Each Hop? |
|---|---|---|
| Layer 3 – Network | IP addresses, routing decisions (end-to-end) | No (except TTL / checksum) |
| Layer 2 – Data Link | MAC addresses, ARP, Ethernet frames | Yes, rebuilt at every router |
| Layer 1 – Physical | Signals on copper, fiber, or wireless | Per link |
Encapsulation Process
PC1: Data → Segment → Packet (IP) → Frame (Ethernet) → Bits R1: Bits → Frame → Packet → (routing decision) → New Frame → Bits R2: Bits → Frame → Packet → (routing decision) → New Frame → Bits PC2: Bits → Frame → Packet → Segment → Data
🗂 ARP Cache Examples
After the full exchange, each device holds these entries:
| Device | ARP Cache Entry |
|---|---|
| PC1 | 192.168.1.1 → R1 LAN MAC (AA:AA:AA:AA:AA:AA) |
| R1 | 192.168.1.10 → PC1 MAC 10.10.10.2 → R2 WAN MAC (BB:BB:BB:BB:BB:BB) |
| R2 | 10.10.10.1 → R1 WAN MAC 192.168.2.20 → PC2 MAC (22:22:22:22:22:22) |
| PC2 | 192.168.2.1 → R2 LAN MAC (it learns this when it receives the ARP request) |
Sample Router Output
R1# show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 192.168.1.1 - aaaa.aaaa.aaaa ARPA GigabitEthernet0/0 Internet 192.168.1.10 2 1111.1111.1111 ARPA GigabitEthernet0/0 Internet 10.10.10.1 - cccc.cccc.cccc ARPA GigabitEthernet0/1 Internet 10.10.10.2 3 bbbb.bbbb.bbbb ARPA GigabitEthernet0/1
An entry with a dash (-) in the Age column belongs to the router's own interface.
ARP Cache Lifetime
- Cisco IOS: dynamic entries last 4 hours by default
- Windows / Linux: entries use shorter, dynamic timers (typically tens of seconds when idle, then they go stale and are re-verified)
⚙ Lab Configuration
You can reproduce the entire topology in Cisco Packet Tracer, GNS3, or EVE-NG.
R1
hostname R1 ! interface GigabitEthernet0/0 description LAN-to-PC1 ip address 192.168.1.1 255.255.255.0 no shutdown ! interface GigabitEthernet0/1 description WAN-to-R2 ip address 10.10.10.1 255.255.255.252 no shutdown ! ip route 192.168.2.0 255.255.255.0 10.10.10.2
R2
hostname R2 ! interface GigabitEthernet0/0 description WAN-to-R1 ip address 10.10.10.2 255.255.255.252 no shutdown ! interface GigabitEthernet0/1 description LAN-to-PC2 ip address 192.168.2.1 255.255.255.0 no shutdown ! ip route 192.168.1.0 255.255.255.0 10.10.10.1
End Devices
PC1: IP 192.168.1.10 Mask 255.255.255.0 Gateway 192.168.1.1 PC2: IP 192.168.2.20 Mask 255.255.255.0 Gateway 192.168.2.1
Test with ping 192.168.2.20 from PC1. In Packet Tracer, use Simulation Mode to watch the ARP and ICMP frames move hop by hop and open each PDU to see the MAC addresses change.
🛠 Verification Commands
| Device | Command | Purpose |
|---|---|---|
| Windows PC | arp -a | View the ARP cache |
| Windows PC | arp -d * | Clear the ARP cache (run as administrator) |
| Linux PC | ip neigh show | View the neighbor (ARP) table |
| Cisco Router | show ip arp | View the ARP table |
| Cisco Router | clear arp-cache | Clear dynamic ARP entries |
| Cisco Router | show ip route | Confirm the next hop for 192.168.2.0/24 |
| Cisco Router | show interfaces GigabitEthernet0/0 | See the interface MAC address (burned-in address) |
| Cisco Switch | show mac address-table | See which MACs were learned on which ports |
| Cisco Router | debug arp | See ARP requests and replies live (use carefully in production) |
🦈 Wireshark Section
Useful Display Filters
| Filter | Shows |
|---|---|
| arp | All ARP packets |
| arp.opcode == 1 | ARP requests only |
| arp.opcode == 2 | ARP replies only |
| eth.dst == ff:ff:ff:ff:ff:ff | Broadcast frames |
| arp.duplicate-address-detected | Duplicate IP detection warnings |
| icmp | Ping packets (to follow the data path) |
Three Capture Points – Same Packet, Different MACs
If you capture the same ping at three places, the IP addresses are identical but the MAC addresses are different:
| Capture Point | Eth Source MAC | Eth Destination MAC | IP Source → Destination |
|---|---|---|---|
| A: PC1 LAN | PC1 | R1 LAN | 192.168.1.10 → 192.168.2.20 |
| B: WAN link | R1 WAN | R2 WAN | 192.168.1.10 → 192.168.2.20 |
| C: PC2 LAN | R2 LAN | PC2 | 192.168.1.10 → 192.168.2.20 |
What to Look For
- Capture A: an ARP request (broadcast) and reply before the first ICMP echo
- Capture B: an ARP exchange between 10.10.10.1 and 10.10.10.2, then the ICMP packets
- Capture C: R2 asking "Who has 192.168.2.20?" and the ICMP packets arriving
- The ICMP TTL value is lower at each capture point because each router subtracts 1
🧩 Special Types of ARP
Proxy ARP
A router answers an ARP request on behalf of a host on another network, using its own MAC address. This lets a host with no default gateway reach remote networks, but it hides routing problems and increases ARP traffic.
Host: "Who has 192.168.2.20?" (host wrongly ARPs for a remote IP) Router: "192.168.2.20 is at AA:AA:AA:AA:AA:AA" (router's own MAC)
Modern networks usually disable it on interfaces with no ip proxy-arp.
Gratuitous ARP
A device sends an ARP message about its own IP address without being asked. Common uses:
- Detect duplicate IP addresses when a device boots
- Update other devices' ARP caches after a NIC or MAC change
- Announce a failover, for example when a first hop redundancy protocol (HSRP / VRRP) or a firewall HA pair changes the active device
ARP Timeouts
Cache entries expire so that stale information is removed when devices move or change hardware.
IPv6 Does Not Use ARP
IPv6 replaces ARP with Neighbor Discovery Protocol (NDP) using ICMPv6 Neighbor Solicitation (type 135) and Neighbor Advertisement (type 136) messages, sent to solicited-node multicast addresses instead of broadcast.
🚨 ARP Security Threats
ARP was designed in a time of trust. It has no authentication: any device can send an ARP reply, and most hosts accept it.
| Threat | Description | Impact |
|---|---|---|
| ARP Poisoning | An attacker sends false ARP replies to corrupt other devices' ARP caches | Traffic is sent to the wrong MAC address |
| ARP Spoofing | The attacker claims to own another device's IP (often the default gateway) | Impersonation of gateway or servers |
| Man-in-the-Middle (MITM) | The attacker sits between victim and gateway, reading or changing traffic | Credential theft, data theft, session hijacking |
| Rogue Device Attack | An unauthorized device is plugged into the network and starts sending ARP traffic | Reconnaissance and further attacks |
| Denial of Service | Poisoning the gateway entry with a non-existent MAC | Users lose connectivity |
How a Poisoning Attack Looks (Concept Only)
Normal: PC → Gateway (AA:AA:...) → Internet
Poisoned: PC → Attacker (wrong MAC in PC's cache) → Gateway → Internet
(Attacker silently sees and can modify the traffic)
Warning Signs
- The same IP address appears with two different MAC addresses
- The gateway's MAC address suddenly changes in a client's ARP cache
- Large numbers of unsolicited (gratuitous) ARP replies
- Duplicate IP address warnings in Wireshark or on end devices
- Switch logs showing "ARP inspection" violations or MAC flapping
🛡 How to Defend Against ARP Attacks
| Defense | How It Helps |
|---|---|
| DHCP Snooping | Builds a trusted binding table of IP ↔ MAC ↔ port ↔ VLAN and blocks rogue DHCP servers |
| Dynamic ARP Inspection (DAI) | Checks ARP packets against the DHCP snooping table and drops invalid ones |
| Port Security | Limits the number of MAC addresses allowed on an access port |
| 802.1X / NAC | Only authenticated users and devices can connect (Zero Trust Network Access) |
| Static ARP Entries | Protect only a few critical devices (such as the gateway); too hard to manage at scale |
| VLAN Segmentation | Reduces the size of each broadcast domain and the number of possible victims |
| Monitoring | Use SIEM, arpwatch, or switch logs to detect duplicate IPs and ARP anomalies |
| Disable Proxy ARP | Removes unnecessary ARP answers from routers |
DHCP Snooping and DAI Configuration Example
! Enable DHCP snooping ip dhcp snooping ip dhcp snooping vlan 10 ! ! Enable Dynamic ARP Inspection on the same VLAN ip arp inspection vlan 10 ! ! Uplink toward the distribution switch / DHCP server = trusted interface GigabitEthernet1/0/48 description Uplink-To-Distribution ip dhcp snooping trust ip arp inspection trust ! ! User ports stay untrusted (default) - add a rate limit interface range GigabitEthernet1/0/1 - 24 ip arp inspection limit rate 15
Static Hosts Without DHCP
Devices with fixed IP addresses (such as a printer or server) are not in the DHCP snooping table, so DAI would drop their ARP packets. Create an ARP access list for them:
arp access-list STATIC-HOSTS permit ip host 192.168.1.50 mac host 0011.2233.4455 ! ip arp inspection filter STATIC-HOSTS vlan 10
Useful DAI Verification
show ip dhcp snooping binding show ip arp inspection vlan 10 show ip arp inspection statistics
🔍 Troubleshooting Scenarios
Scenario 1: ARP Entry Shows "Incomplete"
Meaning: ARP request was sent but no reply was received 1. Is the destination device powered on and connected? 2. Is the cable / switch port up? 3. Are both devices in the same VLAN? 4. Is the IP address and subnet mask correct on both sides? 5. Is a switch security feature (port security, DAI) blocking it?
Scenario 2: PC1 Cannot Reach PC2, but Can Ping the Gateway
ARP to the gateway works, so the problem is beyond the first hop 1. Does R1 have a route to 192.168.2.0/24? (show ip route) 2. Does R2 have a return route to 192.168.1.0/24? 3. Is the R1 - R2 WAN link up and in the same /30? 4. Does an ACL or firewall block ICMP? 5. Is PC2's default gateway set to 192.168.2.1?
Scenario 3: PC1 Cannot Even Ping the Gateway
1. Check cable, port status, and VLAN assignment 2. Verify PC1 IP, mask, and gateway settings 3. Run arp -a on PC1 - is the gateway entry missing or incomplete? 4. Check show mac address-table on the switch 5. Check for port security shutdown (err-disabled)
Scenario 4: Wrong Subnet Mask on PC1
PC1: 192.168.1.10 / 255.255.0.0 (should be 255.255.255.0)
Effect: PC1 thinks other 192.168.x.x addresses are local
and ARPs directly for 192.168.2.20 - no one answers.
Fix: Correct the mask so PC1 sends the packet to the gateway.
Scenario 5: Duplicate IP Address
Symptom: Connectivity works, then stops; ARP entry changes MAC 1. Run arp -a repeatedly and look at the MAC for the IP 2. Look for duplicate address warnings in Windows / Wireshark 3. Find the second device using the switch MAC address table 4. Fix the static or DHCP conflict
Scenario 6: Connectivity Breaks After Replacing a Router or NIC
Cause: Other devices still hold the old MAC in their ARP cache 1. Wait for the entry to age out, or clear the ARP cache 2. Use a gratuitous ARP from the new device if supported
Scenario 7: Suspected ARP Poisoning
1. Compare the gateway's MAC in client ARP caches to the real interface MAC 2. Capture with Wireshark: filter arp.opcode == 2 and look for unsolicited replies 3. Find the offending MAC on the switch: show mac address-table address (MAC) 4. Shut down the port, enable DHCP snooping + DAI, and investigate the device
✅ CCNA / CCNP Exam Tips
- ARP resolves IP to MAC
- ARP works only in the local LAN (same broadcast domain)
- Hosts ARP for the default gateway when the destination is remote
- ARP requests are broadcast; ARP replies are unicast
- Routers do not forward broadcasts
- MAC addresses change at every router hop; IP addresses stay the same
- Switches use MAC address tables; routers use routing tables
- A router interface has its own MAC, so a router has multiple MAC addresses
- Know the difference between Proxy ARP and Gratuitous ARP
- Know DAI depends on DHCP snooping
- IPv6 uses NDP instead of ARP
Common Misconceptions
| Wrong Idea | Correct Idea |
|---|---|
| PC1 sends an ARP for PC2's MAC | PC1 ARPs for its default gateway only |
| The destination MAC stays PC2's MAC all the way | The destination MAC is rewritten at every hop |
| Routers forward ARP broadcasts | Routers stop broadcasts at each interface |
| A router has one MAC address | A router has a MAC address per interface |
| ARP is an IP protocol | ARP rides directly on Ethernet (EtherType 0x0806) |
| ARP is needed for every packet | ARP is needed only when the cache has no valid entry |
💼 Interview Questions and Answers
Q1. What does ARP do?
It maps a known IPv4 address to a MAC address on the local network so a device can build an Ethernet frame.
Q2. Why does a host ARP for the gateway and not for the remote host?
The remote host is on another network. The frame must go to the next hop, which is the default gateway, so that is the MAC the host needs.
Q3. Why do MAC addresses change at every router but IP addresses do not?
MAC addresses only have meaning on one Layer 2 segment. A router removes the old frame and builds a new one for the next segment. IP addresses identify the original source and final destination, so they stay the same (unless NAT is used).
Q4. Is the ARP request broadcast or unicast? And the reply?
The request is a broadcast (FF:FF:FF:FF:FF:FF). The reply is a unicast to the requester.
Q5. Do routers forward ARP requests?
No. Routers do not forward Layer 2 broadcasts, so ARP is limited to one broadcast domain.
Q6. What is Proxy ARP and why is it usually disabled?
A router answers ARP for a remote address using its own MAC. It hides misconfigured gateways, enlarges ARP tables, and can be abused, so it is normally turned off.
Q7. What is Gratuitous ARP?
An unsolicited ARP message a device sends about its own IP. It is used for duplicate IP detection, cache updates, and failover announcements.
Q8. How does DAI work?
DAI intercepts ARP packets on untrusted ports and compares the IP-to-MAC mapping to the DHCP snooping binding table (or an ARP ACL). Invalid packets are dropped and logged.
Q9. What happens to TTL as a packet crosses routers?
Each router decreases the TTL by 1 and recalculates the IP header checksum. When TTL reaches 0, the packet is dropped and an ICMP Time Exceeded message is sent.
Q10. How does IPv6 replace ARP?
Neighbor Discovery Protocol using ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages.
🏆 Best Practices
- Enable DHCP Snooping and DAI on user VLANs
- Use port security and 802.1X / NAC on access ports
- Keep VLANs and broadcast domains reasonably small
- Disable Proxy ARP unless you need it
- Document IP and MAC assignments (for example in NetBox) to spot duplicates quickly
- Send switch and router logs to a SIEM and alert on ARP anomalies
- Use Wireshark captures at several points when troubleshooting forwarding problems
- Always verify both directions: forward route and return route
🎓 Final Summary
In a routed network, every Ethernet frame lives for just one hop. PC1 uses ARP to learn the MAC address of its default gateway, R1 uses ARP to learn the MAC address of its next hop (R2), and R2 uses ARP to learn the MAC address of the final destination (PC2). At every router, the old frame is removed, the routing table is consulted, and a new frame is built with new source and destination MAC addresses.
Meanwhile, the source IP (192.168.1.10) and destination IP (192.168.2.20) stay the same from end to end. This single idea, IP is end-to-end, MAC is hop-by-hop, is the foundation for understanding routing, switching, firewalls, NAT, and troubleshooting.
Because ARP has no built-in authentication, it is also a classic target for poisoning, spoofing, and man-in-the-middle attacks. Layer 2 protections such as DHCP Snooping, Dynamic ARP Inspection, port security, and 802.1X keep this essential protocol safe.
Next step: Build the 2-router lab, capture the ping in Wireshark at all three points, and confirm for yourself that the IP addresses stay the same while the MAC addresses change at every hop.
