Hello guys, You know I used to get stuck thinking about how devices communicate each other, because unlike humans they don't have any senses right. But this concept answered all my questions and i am really excited to share my learning.
So the very important Topic is ARP, here it works at layer 2 with MAC addresses and there are different types in ARP requests like reverse ARP, Gratuitous ARP.
These are the contents i am going to discuss in this blog:
-->ARP Fundamentals
-->ARP Operation in Same Subnet Communication
-->ARP Operation Across Different Networks (via Router)
-->Switch MAC Learning Behavior
-->ICMP Communication Flow
-->Default Gateway Logic
-->Network Addressing Concepts
-->NIC, Network ID, Host ID
-->CCNA Key Concepts
1]Address Resolution Protocol (ARP)
The Address Resolution Protocol (ARP) is defined in RFC 826 and is used to resolve a Layer 3 IPv4 address into a corresponding Layer 2 MAC address within an Ethernet network segment.
In Ethernet LAN communication, devices send frames using MAC addresses, but applications and routing decisions use IP addresses. ARP provides the necessary mapping between these two address types.
ARP entries are temporarily stored in an ARP cache on Layer 3 devices such as hosts and routers.
ARP Operational Behavior:
When a sender needs to discover the MAC address associated with an IP address:
The sender transmits an ARP Request as a Layer 2 broadcast.
All devices in the broadcast domain receive and process the request.
The device that owns the requested IP responds with an ARP Reply.
The ARP Reply is sent as a Layer 2 unicast to the original sender.
Thus:
ARP Request → Broadcast
ARP Reply → Unicast
2. Scenario 1 — Communication Within Same Subnet
Topology:
PC1 (10.1.1.1/24, MAC AAAA) — Switch — PC2 (10.1.1.2/24, MAC BBBB)
All devices initially have empty ARP caches and the switch has an empty MAC address table.
Step-by-Step Communication Process
Step 1 — Layer 3 Subnet Decision (PC1)
When PC1 attempts to ping 10.1.1.2, it first determines whether the destination is local or remote.
Using the subnet mask 255.255.255.0, PC1 performs a logical AND operation on both its own IP address and the destination IP address.
Both results produce the same network ID (10.1.1.0), confirming that the destination is on the same subnet.
PC1 therefore decides that it must send the packet directly to the destination host rather than via a router. To do this, it requires the destination MAC address.
Step 2 — ARP Cache Lookup and Request Generation
PC1 checks its ARP cache and finds no entry for 10.1.1.2.
The ICMP Echo Request packet is temporarily queued while PC1 initiates ARP resolution.
PC1 constructs an ARP Request frame with:
Destination MAC: FF:FF:FF:FF:FF:FF (broadcast)
Source MAC: PC1’s MAC
Sender IP: 10.1.1.1
Target IP: 10.1.1.2
Target MAC: unknown (all zeros)
The broadcast nature ensures all devices in the LAN receive the request.
Step 3 — Switch Processing of ARP Request
The switch receives the broadcast frame on PC1’s port.
Before forwarding, the switch learns the source MAC address and records that PC1’s MAC resides on that port.
Because the destination MAC is broadcast, the switch floods the frame out all ports except the incoming port. PC2 therefore receives the ARP Request.
Step 4 — PC2 Processes ARP Request
PC2 examines the ARP packet and finds that the target IP matches its own IP address.
PC2 therefore:
Updates its ARP cache with PC1’s IP–MAC mapping.
Generates an ARP Reply containing its own MAC address.
The ARP Reply is sent as a unicast frame directly to PC1’s MAC address.
Step 5 — Switch Forwards ARP Reply
The switch receives the ARP Reply on PC2’s port.
It learns PC2’s MAC address location and adds it to the MAC table.
Because the destination MAC (PC1) is known, the switch forwards the frame only to PC1’s port rather than flooding.
Step 6 — PC1 Receives ARP Reply and Sends ICMP
PC1 updates its ARP cache with the mapping:
10.1.1.2 → PC2 MAC
With ARP resolution complete, PC1 retrieves the queued ICMP Echo Request and encapsulates it in an Ethernet frame addressed to PC2’s MAC.
Step 7–10 — ICMP Echo Exchange
The switch forwards the unicast ICMP frame to PC2.
PC2 validates the packet and generates an ICMP Echo Reply.
The reply is sent back through the switch to PC1, completing successful ping communication.
Key Concepts from Same-Subnet Communication:
-->Direct communication occurs when network IDs match.
-->ARP resolves the destination host MAC.
-->Switches learn MAC addresses from source fields.
-->Broadcast frames are flooded; known unicast frames are forwarded selectively.
-->ICMP communication depends on successful ARP resolution.
3. Scenario 2 — Communication Across Different Networks
Topology
PC1 (10.1.1.1/24) — Switch1 — Router — Switch2 — PC2 (10.1.2.2/24)
PC1 default gateway: 10.1.1.254
PC2 default gateway: 10.1.2.254
*Step-by-Step Inter-Network Communication
Step 1 — PC1 Determines Destination is Remote
*
PC1 compares network IDs:
PC1 network: 10.1.1.0
Destination network: 10.1.2.0
Since they differ, PC1 concludes the destination is on another network.
Therefore, the packet must be sent to the default gateway rather than directly to the destination host.
Step 2 — ARP for Default Gateway
PC1 checks its ARP cache for the gateway IP 10.1.1.254 and finds no entry.
PC1 sends an ARP Request asking:
“Who has 10.1.1.254?”
This request is broadcast on the local LAN.
Step 3–5 — Gateway ARP Resolution
The router’s interface with IP 10.1.1.254 receives the request and recognizes the target IP as its own.
The router:
Learns PC1’s MAC
Sends an ARP Reply with its own MAC
PC1 updates its ARP cache with:
10.1.1.254 → Router MAC
Step 6 — Critical Encapsulation Concept
PC1 now sends the ICMP packet.
Important distinction:
Layer 3 destination IP: 10.1.2.2 (PC2)
Layer 2 destination MAC: Router MAC
Thus the frame is addressed to the router, but the IP packet remains addressed to PC2.
*Router Forwarding Process
*
When the router receives the frame:
Layer 2 header is removed.
Router examines IP destination.
Routing table lookup identifies outgoing interface.
Router resolves destination MAC via ARP on the new network.
Router forwards packet with new Layer 2 header.
TTL is decremented by one.
This is the fundamental router forwarding workflow.
4. ARP Across Multiple Networks
Each network segment has its own ARP domain.
Key rule:
Hosts ARP only for devices in their own subnet.
Routers perform ARP on behalf of remote networks.
Thus:
PC1 ARPs for gateway
Router ARPs for PC2
5. Default Gateway Logic
Host decision process:
If destination network = local → direct ARP
If destination network ≠ local → send to gateway
The default route (0.0.0.0/0) in the routing table defines the gateway used for unknown networks.
6. Switch MAC Learning Principles
Switches operate at Layer 2 and learn MAC addresses dynamically.
Rules:
Learn source MAC on ingress
Flood broadcast and unknown unicast
Forward known unicast to specific port
Aging timer removes inactive entries
7. Network Addressing Concepts
NIC (Network Interface Card)
A NIC is the physical hardware that connects a device to a network and contains a unique MAC address.
It converts digital data into electrical or optical signals for transmission.
Network ID
The Network ID is the portion of an IP address that identifies the network.
It is obtained by performing a logical AND between the IP address and subnet mask.
Devices with the same Network ID can communicate directly.
Host ID
The Host ID uniquely identifies a device within a network.
Valid host range excludes:
Network address (all host bits 0)
Broadcast address (all host bits 1)
Default Gateway
The default gateway is the router IP used to reach external networks.
All inter-network communication passes through this gateway.
8. TTL Behavior
Routers decrement the TTL field by one for each hop.
Thus a packet sent with TTL 128 and received with TTL 127 confirms traversal through one router.
9. Complete Communication Model
Same subnet:
Host → ARP → Direct MAC → Destination
Different subnet:
Host → ARP gateway → Router → ARP destination → Destination
CCNA Key Takeaways:
ARP maps IP to MAC within a broadcast domain.
ARP Request is broadcast; ARP Reply is unicast.
Same subnet hosts communicate directly.
Different subnet hosts communicate via gateway.
Routers rewrite Layer 2 headers at each hop.
Switches learn MAC from source addresses.
Each network segment has a separate ARP domain.
TTL decrement proves router traversal.