An interface has two addresses because they answer different questions. The IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 address says where you are; the MAC (Media Access Control) Media Access Control The link-layer address burned into a network interface. Before a host has an IP address it is the only identity it has, which is why DHCP keys on it. Chapter 6 covers it properly. introduced in ch. 4 address says who you are. A protocol called ARP (Address Resolution Protocol) Address Resolution Protocol Translates an IP address into the MAC address of an interface on the same subnet. It works only within one subnet, which is the whole point. introduced in ch. 6 translates one into the other.
Words you will meet
-
MAC address mac address Simple The permanent, flat address burned into an adapter. Precise A link-layer address, also called a LAN address or physical address. It belongs to an adapter rather than to a host, is 6 bytes long for most LANs, and is flat rather than hierarchical — it does not change when the device moves. IEEE manages the address space, selling 2^24-address chunks to manufacturers. introduced in ch. 6 — open in glossary — the link-layer address of an adapter, 6 bytes, written in hexadecimal.
-
Flat flat addressing Simple An address with no parts — it tells you who, never where. Precise An addressing structure with no internal hierarchy, so the address says nothing about where its owner is attached. MAC addresses are flat and never change, however far the adapter travels; IP addresses are hierarchical, with a network part and a host part, and must change when a host moves to another network. The book's analogy: a social security number against a postal address. introduced in ch. 6 — open in glossary — an address with no parts, which therefore says nothing about where its owner is.
-
Broadcast address broadcast address Simple The destination MAC address that means "every adapter on this LAN". Precise A special MAC address that makes every adapter on the LAN accept the frame and pass it up. For LANs with 6-byte addresses the broadcast address is 48 consecutive 1s, written FF-FF-FF-FF-FF-FF. An ARP query is sent to it, because the querier does not yet know which adapter should answer. introduced in ch. 6 — open in glossary — FF-FF-FF-FF-FF-FF, meaning “every adapter on this LAN (Local Area Network) Local Area Network A network covering one building, campus or home. introduced in ch. 1 ”.
-
ARP (Address Resolution Protocol) Address Resolution Protocol Translates an IP address into the MAC address of an interface on the same subnet. It works only within one subnet, which is the whole point. introduced in ch. 6 — takes an IP address on this subnet and returns the matching MAC address.
-
ARP table arp table Simple A host's own list of IP-to-MAC mappings, with an expiry time on each. Precise A table in each host and router holding mappings of IP addresses to MAC addresses, each with a time-to-live saying when it will be deleted. A typical expiry is 20 minutes. The table is built automatically and never needs configuring, and a host that leaves the subnet has its entry deleted from the others in time. introduced in ch. 6 — open in glossary — the mappings a host has learned, each with a time at which it expires.
Why this matters
Chapter 4 gave every host and router an IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 address. So the first honest question about this section is: why does anything need a second address at all?
The answer is that they are not two versions of the same thing. One of them never changes and means nothing outside its own subnet. The other changes every time you move and is understood everywhere.
By the end of this page you will be able to look at one datagram crossing one router. And you will be able to say exactly why it needs two different frames with four different MAC addresses to get there.
Addresses belong to adapters, not to machines
It is not hosts and routers that have link-layer addresses. It is their adapters — their network interfaces. A machine with several interfaces has several MAC addresses, just as it has several IP addresses.
One device on the diagram below has none at all.
Drag any device to rearrange the picture. Hover a link to see its rate, delay and length.
The switch sits in the middle of every conversation and has no link-layer address on these interfaces at all. Its job is to carry frames between hosts and routers transparently, so nothing ever addresses a frame to it.
Read this diagram as text
- C · 222.222.222.220 · 1A-23-F9-CD-06-9B — wired link — switch — no MAC address of its own
- B · 222.222.222.223 · 5C-66-AB-90-75-B1 — wired link — switch — no MAC address of its own
- A · 222.222.222.222 · 49-BD-D2-C7-56-2A — wired link — switch — no MAC address of its own
- switch — no MAC address of its own — wired link — 222.222.222.221 · 88-B2-2F-54-1A-0F
Switches have no MAC address on the interfaces facing hosts and routers. A switch’s job is to carry frames between hosts and routers transparently — without anybody having to address a frame to it. Nothing on this page ever names the switch, and that is the point of it.
Two addresses, two jobs
| MAC addresslink layer | IP addressnetwork layer | |
|---|---|---|
| Size | ||
| Structure | ||
| Does it change when you move? | ||
| Who assigns it? | ||
| How far does it mean anything? | ||
| The book’s analogy |
Cells marked ⓘ have a reason behind them — click to read it.
Two addressing schemes on the same interface, doing different jobs. Click any cell for the reasoning. The book’s analogy runs down the whole table: a social security number against a postal address.
In plain words
A MAC address is like a social security number. It is flat — it has no parts — and it stays with you wherever you go.
An IP address is like a postal address. It is hierarchical, and it must change whenever you move.
A person finds both useful, for different reasons. So does an interface.
The uniqueness is worth a moment. No two adapters anywhere share an address, and no central authority hands them out one at a time.
The IEEE (Institute of Electrical and Electronics Engineers) Institute of Electrical and Electronics Engineers The body whose 802 committee standardises Ethernet and WiFi. introduced in ch. 1 manages the space instead. A manufacturer buys a chunk of 2²⁴ addresses for a nominal fee. The IEEE fixes the first 24 bits, and the company chooses the last 24 for each adapter it makes. A factory in Taiwan and one in Belgium never collide, because they were given different halves of the address to begin with.
When an adapter receives a frame it compares the destination MAC address with its own. On a match it extracts the datagram and passes it up. On a mismatch it discards the frame without disturbing anything above it — so only the intended destination is interrupted.
Unless the address is the broadcast address, 48 consecutive ones, written FF-FF-FF-FF-FF-FF. Then every adapter accepts it.
ARP: from an IP address to a MAC address
Everyday picture
The book’s own image. You are in a crowded room of cubicles at AnyCorp, and you shout:
What is the social security number of the person whose postal address is Cubicle 13, Room 112, AnyCorp, Palo Alto, California?
Everybody hears you, because you shouted. One person recognises the description as their own desk and calls back their number — to you, not to the room.
Where the picture stops. You could in principle shout loud enough to reach the next building. ARP cannot. It resolves addresses only for hosts and router interfaces on the same subnet, and a query for an address in another state simply returns an error.
Each host and router keeps an ARP table of the mappings it has learned.
| IP Address | MAC Address | TTL |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it.
Three columns, and the third is the one that is easy to skip. Notice what is missing from this table.
Two things about that table. The TTL (Time To Live) Time To Live How long a cached DNS record may be kept before it must be fetched again. introduced in ch. 2 column gives the time each mapping will be deleted — typically about 20 minutes after it was placed there. And the table does not hold an entry for every host on the subnet. Some were never entered and others have expired.
In particular this table has no entry for 222.222.222.222, which is exactly the address the book then wants to send to.
Click any arrow to see what that message says and why it is sent.
The book’s cubicle analogy: shouting across a crowded office “what is the social security number of the person at Cubicle 13?”. Everyone hears the question; one person answers, and answers only you.
Read this diagram as text
- 222.222.222.220 sends ARP query — who has 222.222.222.222? to 222.222.222.223. Sent to the MAC broadcast address FF-FF-FF-FF-FF-FF, so every adapter on the subnet accepts the frame and passes the ARP packet up to its ARP module.
- 222.222.222.220 sends the same query, same frame to 222.222.222.222. One frame, received by everybody. Each ARP module compares its own IP address with the target IP in the packet.
- 222.222.222.223 sends no match — discarded to 222.222.222.223 — lost. 222.222.222.223 is not the address being asked about, so this module simply drops the packet. It answers nothing.
- 222.222.222.222 sends ARP response — 222.222.222.222 is at 49-BD-D2-C7-56-2A to 222.222.222.220. The one module with a match replies. This frame is NOT broadcast: the answer is wanted by exactly one host, and the query said which.
Lifelines, left to right: 222.222.222.220 (host), 222.222.222.223 (host), 222.222.222.222 (host).
The query goes out in a broadcast frame, because the sender does not yet know which adapter should answer. The response comes back in an ordinary frame, because by then it does.
ARP is plug-and-play. The table builds itself, no administrator configures it, and when a host leaves the subnet its entry eventually disappears from everyone else’s table.
Is ARP a link-layer protocol or a network-layer one?
The book says students often ask, and then declines to give a clean answer, because there is not one.
An ARP packet is carried inside a link-layer frame, which puts it above the link layer. It carries link-layer addresses, which argues that it is a link-layer protocol. It also carries network-layer addresses, which argues the opposite.
The book’s verdict: ARP straddles the boundary, and does not fit neatly into the layered stack of chapter 1. Real protocols are like that.
Sending a datagram off the subnet
Now the hard part, and the reason this section exists.
Drag any device to rearrange the picture. Hover a link to see its rate, delay and length.
One router, two subnets, and six interfaces. The router has an IP address, an ARP module and an adapter for each of its two interfaces — so it has two of each, and two MAC addresses.
Read this diagram as text
- 111.111.111.111 · 74-29-9C-E8-FF-55 — wired link — switch
- 111.111.111.112 · CC-49-DE-D0-AB-7D — wired link — switch
- switch — wired link — 111.111.111.110 · E6-E9-00-17-BB-4B · 222.222.222.220 · 1A-23-F9-CD-06-9B
- 111.111.111.110 · E6-E9-00-17-BB-4B · 222.222.222.220 · 1A-23-F9-CD-06-9B — wired link — switch
- switch — wired link — 222.222.222.221 · 88-B2-2F-54-1A-0F
- switch — wired link — 222.222.222.222 · 49-BD-D2-C7-56-2A
These addresses were used before, with different jobs
Figures 6.17 and 6.19 reuse the same addresses for different roles. If you memorised the first diagram, the second will mislead you.
- 222.222.222.220 · 1A-23-F9-CD-06-9B was host C in Figure 6.17. Here it is a router interface.
- 222.222.222.221 · 88-B2-2F-54-1A-0F was the router in Figure 6.17. Here it is a host.
They are two independent examples, not a contradiction. But read each figure on its own, and do not carry a role across from the other.
Host 111.111.111.111 wants to reach 222.222.222.222. One might guess the frame should carry that host’s MAC address, 49-BD-D2-C7-56-2A. That guess would be wrong.
Seven steps for two pages of the book. Step 1 is the wrong answer on purpose — the book raises it first, and a reader who has not felt its appeal will not remember why it fails.
Read all steps as text
- The tempting wrong answer — Host 111.111.111.111 wants to reach 222.222.222.222. One might guess the frame should carry that host’s MAC address, 49-BD-D2-C7-56-2A. That guess would be wrong.
- A frame never leaves its own link — That is the rule underneath everything on this page. A MAC address only means something on one subnet, so a frame can only be addressed to something on the same subnet as its sender.
- So address the frame to the first-hop router — For the datagram to reach Subnet 2 it must first reach router interface 111.111.111.110. That interface IS on Subnet 1, so its MAC address is a legal destination for the frame.
- How does the host learn that MAC address? — By using ARP, of course. The host broadcasts a query for 111.111.111.110 on Subnet 1 — an address on its own subnet, which is the only kind ARP can resolve.
- The router unwraps, decides, and rewraps — The router’s Subnet 1 adapter sees the frame is addressed to it and passes the datagram up. Its forwarding table says the datagram leaves by interface 222.222.222.220.
- A second ARP, on the second subnet — The router now needs the MAC address of 222.222.222.222, and asks its own ARP module on its own subnet. A router has one ARP module and one adapter per interface.
- A brand new frame, and this time the guess is right — The router builds a second frame on Subnet 2. Only now is the destination MAC address that of the ultimate destination. The datagram inside it has not changed its addresses at all.
The same journey, in the bytes
Everything above is a claim about what is in a frame. Here are the frames — one ping from 111.111.111.111 to 222.222.222.222 and its reply, carried by ICMP (Internet Control Message Protocol) Internet Control Message Protocol Carries error and diagnostic messages between hosts and routers. A ping is an ICMP message. Covered in §5.6. introduced in ch. 2 , with every ARP frame the journey needed.
| No. | Time | Source | Destination | Protocol | Length | Info |
|---|---|---|---|---|---|---|
| 1 | 0.000000 | 74:29:9c:e8:ff:55 | Broadcast | ARP | 60 | Who has 111.111.111.110? Tell 111.111.111.111 |
| 2 | 0.000400 | e6:e9:00:17:bb:4b | 74:29:9c:e8:ff:55 | ARP | 60 | 111.111.111.110 is at e6:e9:00:17:bb:4b |
| 3 | 0.000900 | 111.111.111.111 | 222.222.222.222 | ICMP | 58 | Echo (ping) request id=0x1c46 seq=1 |
| 4 | 0.001300 | 1a:23:f9:cd:06:9b | Broadcast | ARP | 60 | Who has 222.222.222.222? Tell 222.222.222.220 |
| 5 | 0.001600 | 49:bd:d2:c7:56:2a | 1a:23:f9:cd:06:9b | ARP | 60 | 222.222.222.222 is at 49:bd:d2:c7:56:2a |
| 6 | 0.002000 | 111.111.111.111 | 222.222.222.222 | ICMP | 58 | Echo (ping) request id=0x1c46 seq=1 |
| 7 | 0.002400 | 222.222.222.222 | 111.111.111.111 | ICMP | 58 | Echo (ping) reply id=0x1c46 seq=1 |
| 8 | 0.002900 | 222.222.222.222 | 111.111.111.111 | ICMP | 58 | Echo (ping) reply id=0x1c46 seq=1 |
Packet 1 — Subnet 1. The sending host wants to reach 222.222.222.222, which is NOT on its subnet, so it needs the MAC address of its first-hop router — not of the destination. The query goes to the MAC broadcast address FF-FF-FF-FF-FF-FF, so every adapter on the subnet passes it up to its ARP module.
Protocol tree — click a field
The actual bytes
0000 ff ff ff ff ff ff 74 29 9c e8 ff 55 08 06 00 01 ......t)...U....0010 08 00 06 04 00 01 74 29 9c e8 ff 55 6f 6f 6f 6f ......t)...Uoooo0020 00 00 00 00 00 00 6f 6f 6f 6e 00 00 00 00 00 00 ......ooon......0030 00 00 00 00 00 00 00 00 00 00 00 00 ............
Merged from two capture points, one on each subnet, because no single machine can see both. Packets 3 and 6 are the same datagram on either side of the router: identical IP addresses, and not one Ethernet address in common.
In plain words
Open packet 3 and then packet 6 and put them beside each other.
- The IP source and destination are identical: 111.111.111.111 to 222.222.222.222.
- The ICMP message inside is identical byte for byte.
- The Ethernet header has not one address in common between them.
- The only other difference is the time to live, 64 then 63, and the header checksum that had to be recomputed because of it.
That pair is the whole section. The datagram is addressed end to end and travels unchanged. The frame is addressed hop by hop and is thrown away and rebuilt at every one.
Notice also what happens after packet 6. The reply crosses both subnets with no further ARP frames at all. Answering a query teaches you the querier’s mapping for free. Four ARP frames covered the whole exchange, and none will be needed again for about twenty minutes.
Check yourself
Check yourself
0 of 8 answered1.A router has three interfaces. How many MAC addresses and ARP modules does it have?
2.In Figure 6.17 the switch sits between every pair of communicating hosts. What is its MAC address?
3.Why is a MAC address described as flat, and what follows from it?
4.Why is an ARP query sent in a broadcast frame while the response is not?
5.predictHost 111.111.111.111 sends a datagram to 222.222.222.222, on the far side of a router. What MAC address goes in the first frame?
6.predictIn the capture, packets 3 and 6 are the same datagram on either side of the router. What differs between them?
7.predictAfter the ping request arrives, the reply travels back across both subnets. How many ARP queries does that take?
8.Is ARP a link-layer protocol or a network-layer protocol?
What to remember
- Addresses belong to adapters, not machines. MAC addresses are 6 bytes, flat, and permanent; IP addresses are hierarchical and change when you move.
- ARP resolves only within one subnet. The query is broadcast, the response is not — the querier does not know who should answer, and the answerer does know who asked.
- To send off the subnet, address the frame to the first-hop router, never to the far host. One datagram, two frames, four MAC addresses: the datagram’s addresses never change, the frame’s change at every hop.