MAC Addressing and ARP
MAC Protocols
A MAC protocol specifies the rules for transmitting frames on a link. The MAC layer is responsible for flow control and multiplexing of the transmission medium, and MAC addresses are mainly used to identify the interconnected nodes of a data link.
A MAC address is usually written as 12 hexadecimal digits, with a colon between every two digits, such as 08:00:20:0A:8C:6D. The first 6 hexadecimal digits of a MAC address identify the network hardware manufacturer and are assigned by the IEEE; the last 6 hexadecimal digits are the serial number of one of that manufacturer's network products.
The Structure of a MAC Address
A MAC address is 48 bits long. Strictly speaking, MAC addresses belong not to hosts or routers but to their network adapters (interfaces): a router with several interfaces has several MAC addresses. A MAC address is written into the adapter at the factory and normally never changes. It is also "flat", carrying no information about location. Wherever a laptop connects, its MAC address stays the same, while its IP address changes with the subnet it joins. Compare a person's ID number with their postal address: the former goes wherever the person goes, the latter depends on where they live.
The 24-bit manufacturer number at the front of a MAC address is called the OUI (Organizationally Unique Identifier). The IEEE makes sure different manufacturers get different OUIs, and each manufacturer makes sure its adapters' serial numbers never repeat, so every adapter's MAC address is globally unique. The two lowest bits of the first byte have special meanings:
| Bit | When 0 | When 1 |
|---|---|---|
| I/G (lowest bit of the first byte) | Individual address (unicast) | Group address (multicast) |
| U/L (second-lowest bit of the first byte) | Universally unique, determined by the IEEE-assigned OUI | Locally administered, such as the randomized address a phone uses for privacy |
The all-ones address FF:FF:FF:FF:FF:FF is the broadcast address: every adapter on the LAN accepts a frame sent to it. When an adapter receives a frame, it checks the destination MAC address. If it equals the adapter's own address, the broadcast address, or a multicast address the adapter has joined, the adapter passes the data up; otherwise it discards the frame without disturbing the host's CPU.
Decode a MAC address and see who accepts the frame
Unlock the complete interactive lab, deeper explanations, and curated reference answers.
KNOWLEDGE QUIZ
The Address Resolution Protocol (ARP)
When a host sends an IP datagram, it knows the destination IP address, but to encapsulate the datagram in a frame the adapter also needs the destination MAC address. The Address Resolution Protocol (ARP) translates IP addresses into MAC addresses within one subnet.
Every host and router keeps an ARP table that records IP-to-MAC mappings together with a time-to-live (TTL) for each entry; entries typically expire after about 20 minutes. When the destination IP address a host wants to reach is not in its ARP table:
- The sender builds an ARP query packet containing its own IP and MAC addresses and the target IP address it is asking about.
- The packet is sent in a broadcast frame with destination FF:FF:FF:FF:FF:FF and type 0x0806, so every adapter on the subnet passes it to its ARP module.
- Only the node whose IP address matches the target sends back an ARP reply in a unicast frame, telling the querier its MAC address; it may also record the querier's mapping.
- The querier stores the mapping in its ARP table and then sends the original datagram.
ARP is plug-and-play: the table builds itself with no administrator configuration. An ARP packet is carried inside a link-layer frame yet contains IP addresses, so ARP can be seen as a protocol that straddles the boundary between the link and network layers.
Sending Beyond the Subnet
ARP works only within one subnet. If the destination IP address is not in the local subnet, the sender first hands the datagram to its default gateway (the first-hop router). It uses ARP to resolve the MAC address of the gateway's interface, and the frame's destination MAC address is the gateway's, while the destination IP address inside the datagram is still the final destination host. The router extracts the datagram from the frame, consults its forwarding table to pick the output interface, uses ARP on the next subnet to resolve the next hop's MAC address, and sends the datagram out in a new frame.
Resolve MAC addresses with ARP
Unlock the complete interactive lab, deeper explanations, and curated reference answers.
KNOWLEDGE QUIZ
Trace every frame from A to B across a router
Host A sends an IP datagram to host B on another subnet through router R. All ARP tables are empty at the start.
- List, in order, every frame sent on the two subnets, with its source and destination MAC addresses and, for datagrams, the IP addresses inside.
- Which addresses change as the datagram crosses R, and which stay the same?
- How many ARP broadcasts are sent in total? Does A ever learn B's MAC address?
Simulate an ARP cache with expiry in Python
Host 192.168.1.10/24 uses gateway 192.168.1.1. Write Python with a dictionary cache ip → (mac, expires) and a 20-minute TTL. For each event (time in seconds, destination IP) in [(0, 192.168.1.20), (5, 93.184.216.34), (60, 192.168.1.20), (90, 8.8.8.8), (1300, 192.168.1.20)], decide the next hop, look it up, and print whether it was a cache hit or required an ARP query. Assume the neighbors' replies are 192.168.1.1 → 00:00:0C:12:34:56 and 192.168.1.20 → 00:1B:21:3A:4F:10.