Two addresses move every packet: the IP (logical, end-to-end) and the MAC (physical, hop-to-hop). ARP is the glue that maps one to the other on a LAN.
Why: a packet carries an IP address (Layer 3) that stays the same end-to-end, and a MAC address (Layer 2) that changes at every hop — confusing the two is the root of most beginner networking mistakes. When: think IP for "which network/host," MAC for "which device on this local wire." Where: the IP identifies the destination; the MAC gets it across one link.
IP (Layer 3) 192.168.1.10 logical, end-to-end, stays constant
MAC (Layer 2) 00:1A:2B:3C:4D:5E physical, per-hop, changes each link
A router receives a frame, strips the Layer-2 MAC header, and rewrites
it with the NEXT hop's MAC. The IP addresses don't change.Why: to send a frame on the local network, a host needs the destination’s MAC, but it only knows the IP — ARP broadcasts "who has this IP?" and caches the reply. When: ARP happens automatically before the first packet to any local host. Where: it only works within a single LAN/broadcast domain; for remote hosts a device ARPs for the gateway instead.
Host A wants to reach 192.168.1.20 (same LAN):
A -> broadcast: "Who has 192.168.1.20? Tell 192.168.1.10"
B -> A (unicast): "192.168.1.20 is at 00:1A:2B:3C:4D:5E"
A caches the mapping and sends the frame to B's MAC.
For a REMOTE host, A instead ARPs for its default gateway's MAC.Why: the ARP cache shows which IP-to-MAC mappings a machine has learned, and it is one of the first things you check when local connectivity is broken. When: use it to confirm a host actually resolved its neighbor or gateway. Where: a missing or incomplete entry points to a Layer-2 problem (bad cable, wrong VLAN, switch issue).
# Show the ARP cache on your machine:
arp -a # Windows / macOS
ip neighbor # Linux (modern)
# Example output — IP mapped to the MAC it was learned on:
# 192.168.1.1 ether 00:1a:2b:3c:4d:5e C eth0 (the gateway)