Switched LANs and ARP

A switched local area network (LAN) allows devices to communicate using layer-2 switches.

Example of a local network with 4 switches connecting:

• 1 router
• 2 servers
• 3 departments

Switches operate at the link layer:

• they forward link-layer frames (rather than network-layer datagrams)
• they do not examine network-layer (IP) addresses
• they do not run routing protocols (like OSPF) to determine paths

Instead, switches use link-layer (MAC) addresses to identify interfaces on the local network.

To understand how switches forward frames, we first need to understand MAC addresses.

A host or router with multiple network interfaces (such as Ethernet and Wi-Fi) has:

• one MAC address for each interface
• one IP address for each interface

Both kinds of addresses are needed because they serve different purposes.

MAC addresses (Media Access Control)

Every network interface has a unique MAC address:

• the IEEE manages the MAC address space
• when a company manufactures network adapters, it purchases a block of MAC addresses (2²⁴ addresses) to assign to its devices

A MAC address is 48 bits (6 bytes) long (2⁴⁸ possible addresses) expressed in hexadecimal notation:

MAC address vs. IP address:

MAC address	IP address
Flat structure	Hierarchical structure (network part + host part)
Stays the same regardless of where the device is connected	Changes when the device joins a different network
Analogous to a person's social security number: unique permanent does not depend on location	Analogous to a person's postal address: depends on where they live changes when they move

When an adapter wants to send a frame:

1. it places the destination MAC address in the frame header
2. it sends it onto the local network (LAN)

Sometimes a switch forwards a frame to every interface (broadcast), so devices may receive frames that are not meant for them.

When an interface receives a frame:

• it checks the destination MAC address
• if the address matches its own (or is a special broadcast address), it extracts the IP packet and passes it up the protocol stack
• otherwise, it discards the frame

ARP (IPv4 Address Resolution Protocol)

When a device wants to send data over the LAN, it needs the destination's MAC address, not just its IP address.

ARP (Address Resolution Protocol, RFC 826), maps an IPv4 address to its corresponding MAC address.

Suppose host 222.222.222.220 wants to send an IP datagram to host 222.222.222.222 on the same subnet:

• if the sender already knows the MAC address, it encapsulates the IP datagram in a link-layer frame and sends it
• if it does not know the MAC address, it uses ARP:
  • the sender asks ARP to resolve: 222.222.222.222 → ?
  • ARP returns the corresponding MAC address, e.g., 49-BD-D2-C7-56-2A

This is similar to DNS, but with a different purpose:

• DNS: hostname → IP address (anywhere on the Internet)
• ARP: IP address → MAC address (only within the same subnet)

How ARP works?

Each host and router maintains an ARP table, which stores recently learned IP-to-MAC mappings:

IP                  Address MAC Address     TTL
222.222.222.221     88-B2-2F-54-1A-0F       13:45:00
222.222.222.223     5C-66-AB-90-75-B1       13:52:00

• each entry has a TTL (Time To Live)
• entries expire after a period of time (often around 20 minutes, depending on the implementation)
• the table may not contain every device on the subnet

If the destination's MAC address is not in the ARP table:

Step	Description
1	The sender broadcasts an ARP request asking: Who has IP address 222.222.222.222?
2	Every device on the subnet receives the broadcast.
3	Each device checks whether the requested IP address matches its own.
4	The matching device sends an ARP reply directly to the sender with its MAC address.
5	The sender: stores the mapping in its ARP table sends the IP datagram

Key points:

• ARP requests are sent as broadcast frames
• ARP replies are sent as unicast frames
• ARP is plug-and-play: ARP tables are built and updated automatically

Is ARP a link-layer or network-layer protocol?

• it works with both MAC addresses and IP addresses
• ARP packets are encapsulated inside link-layer frames

So, ARP is generally considered a protocol that operates between the link layer and the network layer.

Communication outside the local subnet

When a host sends an IP datagram to a different subnet, it must first send it to a router, which then forwards it toward the destination.

The example network has two subnets connected by a router:

• subnet 1: 111.111.111/24
• subnet 2: 222.222.222/24

Suppose host 111.111.111.111 wants to send an IP datagram to host 222.222.222.222:

Step	Description
1	The sending host already knows the destination IP (from the application or DNS).
2	The host determines that the destination IP is off-subnet using its subnet mask, so it forwards the datagram to its configured default gateway (the next-hop router on the local network).
3	Using ARP, the host resolves the MAC address of the router's interface on the local subnet (111.111.111.110 → E6-E9-00-17-BB-4B).
4	The host sends a frame with: destination MAC: the router (E6-E9-00-17-BB-4B) destination IP: the final destination (222.222.222.222)
5	The router receives the frame, recognizes its own MAC address, decapsulates the IP datagram, and passes it to the network layer, where it consults its forwarding table and decrements the TTL.
6	The router determines the outgoing interface, and if needed, uses ARP on that interface to resolve the MAC address of the final destination (or the next hop if it is not directly connected). It then re-encapsulates the IP datagram into a new frame for forwarding.
7	The new frame is sent onto subnet 2, where it is delivered to host 222.222.222.222.

IP destination stays the same end-to-end, but MAC addresses change at every hop.