Address Resolution Protocol (ARP) and Ethernet switching

An Ethernet switch has three main functions. This walkthrough focuses on the first two — both related to forwarding Ethernet frames — using the scenario below.

(Image 033) Image Title - PC A and PC B connected to Switch-1

PC A would like to send pings to PC B. PC A is connected to Switch-1’s GigabitEthernet0/2 port and PC B is connected to Switch-1’s GigabitEthernet0/3.

PC A pings PC B

Assume you’ve opened a command prompt on PC A, and that both PC A and PC B already have valid IP addresses on the same LAN. You can now ping PC B by entering:

ping 192.168.1.3

Sidenote

Starting assumptions

This example assumes PC A and PC B have never communicated before this ping, and that PC B hasn’t sent any frames into the network yet.

(Image 036) Image Title - Pinging PC B

Step 1: After you run the ping command, PC A checks whether PC B’s IP address is on the same network. It does this with a Boolean “Logical AND” — comparing its own IP address and subnet mask against PC B’s IP address. (We’ll cover how to calculate IP ranges when we get to IPv4 addressing; for now, assume PC A and PC B are on the same LAN.)

Step 2: Since PC A and PC B are on the same network, does PC A need to use its default gateway?

Step 3: PC A now builds an Ethernet frame to carry the ICMP (Ping) Echo Request and starts filling in the required fields.

Devices on a LAN communicate using both IP addresses and MAC addresses — every IP address should have an associated MAC address, and vice versa. A MAC address is the physical address burned into a device’s NIC (or a router interface). Switches forward frames from port to port using the destination MAC address — the core of Layer 2 forwarding. Endpoints use both:

• the Layer 3 IP address, to identify the destination logically, and
• the Layer 2 MAC address, to deliver the frame locally.

Switches, however, only care about MAC addresses.

(Ethernet Frame Diagram - Ping Echo Request) (Description of an Ethernet Frame)

Step 4: The frame’s destination MAC address field is empty — PC A has never talked to PC B, so it doesn’t know PC B’s MAC address yet.

PC A checks its Address Resolution Protocol (ARP) cache, a table hosts (endpoints and routers) use to store IP-to-MAC mappings for other devices on the LAN. Since PC A has never contacted PC B, there’s no entry for it yet.

(PC A’s ARP Table)

Step 5: A host must fill in every required field to send an Ethernet frame — so PC A must drop this incomplete frame.

To learn PC B’s MAC address, PC A sends an ARP Request. ARP is the protocol hosts use to resolve a known IP address into its MAC address. Conceptually, the sender is asking: “I know your IP address — what MAC address should I use to reach you?” The destination host answers with an ARP Reply containing its MAC address.

(Image 037) Image title - Sender Host sending ARP Request to Destination Host

Step 6: PC A builds an Ethernet frame containing the ARP Request. All required fields are filled in this time, so PC A sends it out its NIC — and Switch-1 receives it.

(Ethernet Frame containing PC A’s ARP Request)

How the switch learns and forwards the ARP request and reply

Step 7: Once Switch-1 receives the frame, it performs two of its three main functions:

Address Learn: the switch reads the Source MAC Address field, associates that MAC with the port the frame arrived on, and stores the mapping in its MAC address table — the database it uses to know which port to reach each MAC address on.

(Image 038) Screenshot of SW1’s MAC Address Table

As shown above, PC A’s MAC address (00:00:00:AA:AA:AA) was learned on GigabitEthernet 0/2.

Forward/Filter: next, the switch checks the Destination MAC Address field.

(Diagram of the Ethernet Frame containing the ARP Request)

The destination MAC is all F’s — a broadcast address. A frame addressed to FF:FF:FF:FF:FF:FF is a Broadcast Frame, meant for every host on the LAN.

Hosts use broadcast frames when they need to reach a device but don’t yet know its MAC address — which is why ARP Requests are broadcast.

Since the destination is broadcast, Switch-1 floods the frame — sending copies out every port except the one it arrived on.

That’s the “filter” in “Forward/Filter”: the switch deliberately doesn’t send the frame back out the port it came in on, since that’s unnecessary and can contribute to switching loops (covered later).

Step 8: PC B receives the flooded frame and stores PC A’s MAC address (from the Source MAC Address field) in its own ARP cache — even though the frame wasn’t addressed to it specifically. That mapping will be useful if PC B ever needs to reach PC A later.

(PC B’s ARP Table)

Step 9: PC B checks the destination IP address inside the packet, confirms it’s addressed to PC B, and inspects the packet’s Payload.

The payload is the data the IP packet carries — often a Layer 4 (TCP or UDP) segment, but here it’s PC A’s ARP Request.

Image Title - (Diagram of IP Packet Payload containing PC A’s ARP Request)

Step 10: Confirming it’s the target, PC B builds an Ethernet frame containing an ARP Reply with its own MAC address, and sends it to Switch-1.

Image Title - (Diagram of Ethernet Frame containing PC B’s ARP Reply)

PC B can fill in PC A’s MAC address as the destination because it just learned it from the ARP Request.

Step 11: Switch-1 receives PC B’s ARP Reply frame and performs the same two functions again.

What’s the first function it performs?

What does that function do here?

(Image 039) Screenshot of SW1’s MAC Address Table after PC B’s ARP Reply

What’s the second function?

This time, Forward/Filter behaves a bit differently. The destination MAC is unicast — PC A’s MAC address, addressed to just one host — so the switch doesn’t flood it. Instead, it looks up that MAC in its table, finds it on GigabitEthernet 0/2, and forwards the frame only out that specific port.

Unknown unicasts. That’s how Forward/Filter handles a unicast destination the switch has learned. If it receives a unicast frame for a MAC address it hasn’t learned — an Unknown Unicast frame — it floods it out every port except the one it arrived on, just like a broadcast, hoping the destination host responds so it can learn where it is. This can happen if the sender already has an ARP entry for the destination from a past conversation, but the switch never saw that host’s traffic (or its table entry expired, or the switch rebooted and cleared its table).

Some hosts never send broadcasts or initiate ARP Requests — you’d never know they were on the LAN if there was no prior communication initiated by another host, or if the switch wasn’t able to handle Unknown Unicast frames properly. These are called Silent Hosts, common among IoT and industrial devices, which is exactly why handling Unknown Unicast frames correctly matters.

PC A completes the ping to PC B

Step 12: PC A receives the ARP Reply and stores PC B’s MAC address in its ARP cache. It finally has what it needed — now it can send the ping.

(Updated ARP Table for PC A containing PC B’s associated MAC Address)

Step 13: PC A builds a new Ethernet frame containing the Ping Echo Request — all fields filled in this time — and sends it to Switch-1.

(Diagram of Frame from PC A containing a Ping Echo Request all filled out)

Step 14: Switch-1 already has PC A’s MAC address in its table, so it just resets that entry’s MAC Address Aging Timer back to zero.

Step 15: What will Switch-1’s Forward/Filter function do with this frame?

Step 16: PC B receives the frame and resets its existing ARP cache entry for PC A. It confirms the frame’s destination MAC and the packet’s destination IP both match its own (if either didn’t match, it would discard the packet here), then inspects the payload and finds an ICMP (Ping) Echo Request.

Image Title - (Diagram of IP Packet Payload containing PC A’s Ping Echo Request)

ICMP rules require PC B to reply to an Echo Request with an ICMP Echo Reply, sent to the address in the packet’s Source IP Address field.

Step 17: PC B builds an Ethernet frame containing the Ping Echo Reply and sends it to Switch-1.

Image Title - (Diagram of Ethernet Frame containing PC B’s Ping Echo Reply)

Step 18: Switch-1 receives the frame and performs its two functions again. Which port does it forward the reply out of?

Step 19: PC A receives the reply — the ping is successful.

Sidenote

Pinging on Windows machines

Windows sends 4 consecutive pings by default and expects all 4 replies. Any missed replies count as “loss,” and Windows reports the loss percentage along with the round-trip time (RTT) — how long each reply took to come back.