Address Resolution Protocol (ARP) and Ethernet switching
PC A would like to send pings to PC B. PC A is connected to Switch-1’s GigabitEthernet0/2 port and PC B is connected to Switch-1’s GigabitEthernet0/3.
PC A pings PC B
Assume you’ve opened a command prompt on PC A, and that both PC A and PC B already have valid IP addresses on the same LAN. You can now ping PC B by entering:
Step 1: After you run the ping command, PC A checks whether PC B’s IP address is on the same network. It does this with a Boolean “Logical AND” — comparing its own IP address and subnet mask against PC B’s IP address. (We’ll cover how to calculate IP ranges when we get to IPv4 addressing; for now, assume PC A and PC B are on the same LAN.)
Step 2: Since PC A and PC B are on the same network, does PC A need to use its default gateway?
No — a device only needs its default gateway when sending to an IP address outside its own network.
Step 3: PC A now builds an Ethernet frame to carry the ICMP (Ping) Echo Request and starts filling in the required fields.
Devices on a LAN communicate using both IP addresses and MAC addresses — every IP address should have an associated MAC address, and vice versa. A MAC address is the physical address burned into a device’s NIC (or a router interface). Switches forward frames from port to port using the destination MAC address — the core of Layer 2 forwarding.
Endpoints use both:
- the Layer 3 IP address, to identify the destination logically, and
- the Layer 2 MAC address, to deliver the frame locally.
Switches, however, only care about MAC addresses.
Step 4: The frame’s destination MAC address field is empty — PC A has never talked to PC B, so it doesn’t know PC B’s MAC address yet.
PC A checks its Address Resolution Protocol (ARP) cache, a table hosts (endpoints and routers) use to store IP-to-MAC mappings for other devices on the LAN. Since PC A has never contacted PC B, there’s no entry for it yet.
Step 5: A host must fill in every required field to send an Ethernet frame — so PC A must drop this incomplete frame.
To learn PC B’s MAC address, PC A sends an ARP Request. ARP is the protocol hosts use to resolve a known IP address into its MAC address. Conceptually, the sender is asking: “I know your IP address — what MAC address should I use to reach you?” The destination host answers with an ARP Reply containing its MAC address.
Step 6: PC A builds an Ethernet frame containing the ARP Request. All required fields are filled in this time, so PC A sends it out its NIC — and Switch-1 receives it.
How the switch learns and forwards the ARP request and reply
Step 7: Once Switch-1 receives the frame, it performs two of its three main functions:
Address Learn: the switch reads the Source MAC Address field, associates that MAC with the port the frame arrived on, and stores the mapping in its MAC address table — the database it uses to know which port to reach each MAC address on.
As shown above, PC A’s MAC address (00:00:00:AA:AA:AA) was learned on GigabitEthernet 0/2.
Forward/Filter: next, the switch checks the Destination MAC Address field.
The destination MAC is all F’s — a broadcast address (refer to the image above with the new frame containing PC A’s ARP Request).
A frame addressed to FF:FF:FF:FF:FF:FF is a Broadcast Frame, meant for every host on the LAN.
Since the destination is broadcast, Switch-1 floods the frame — sending copies out every port except the one it arrived on.
Step 8: PC B receives the flooded frame and stores PC A’s MAC address (from the Sender Hardware Address (Sender MAC) field within the ARP packet payload) in its own ARP cache — even though the frame wasn’t addressed to it specifically. That mapping will be useful if PC B ever needs to reach PC A later.
Step 9: PC B checks the destination IP address inside the packet, confirms it’s addressed to PC B, and inspects the packet’s Payload.
Step 10: Confirming it’s the target, PC B builds an Ethernet frame containing an ARP Reply, (which includes it’s associated MAC address) and sends it to Switch-1.
Step 11: Switch-1 receives PC B’s ARP Reply frame and performs the same two functions again.
What’s the first function it performs?
Address Learn
What does that function do here?
It learns the Source MAC Address (00:00:00:BB:BB:BB), associates it with the port the frame arrived on, and stores it in the MAC address table.
What’s the second function?
Forward/Filter
This time, Forward/Filter behaves a bit differently. The destination MAC is unicast — PC A’s MAC address, addressed to just one host — so the switch doesn’t flood it. Instead, it looks up that MAC in its table, finds it on GigabitEthernet 0/2, and forwards the frame only out that specific port.
PC A completes the ping to PC B
Step 12: PC A receives the ARP Reply and stores PC B’s MAC address in its ARP cache. It finally has what it needed — now it can send the ping.
Step 13: PC A builds a new Ethernet frame containing the Ping Echo Request — all fields filled in this time — and sends it to Switch-1.
Step 14: Switch-1 already has PC A’s MAC address in its table, so it just resets that entry’s MAC Address Aging Timer back to zero.
Step 15: What will Switch-1’s Forward/Filter function do with this frame?
Look up the destination MAC (PC B’s, 00:00:00:BB:BB:BB) in its table, and forward the frame only out GigabitEthernet 0/3 — the port it learned PC B on — since this is a unicast frame.
Step 16: PC B receives the frame and resets its existing ARP cache entry for PC A. It confirms the frame’s destination MAC and the packet’s destination IP both match its own (if either didn’t match, it would discard the packet here), then inspects the payload and finds an ICMP (Ping) Echo Request. (Refer to the diagram of the new frame containing PC A’s ICMP Echo Request above).
ICMP rules require PC B to reply to an Echo Request with an ICMP Echo Reply, sent to the address in the packet’s Source IP Address field.
Step 17: PC B builds an Ethernet frame containing the Ping Echo Reply and sends it to Switch-1.
Step 18: Switch-1 receives the frame and performs its two functions again. Which port does it forward the reply out of?
GigabitEthernet 0/2
Step 19: PC A receives the reply — the ping is successful.