Guides2026-11-08•10 min read

Address Resolution Protocol (ARP) Explained: Broadcast Requests, Unicast Replies & Gateway Resolution

BrainyTools Editor

Tech Contributor at BrainyTools

Address Resolution Protocol (ARP) Explained: Broadcast Requests, Unicast Replies & Gateway Resolution

When a host knows the destination IPv4 address it wants to ping, why can't it transmit the packet right away? Because Ethernet NICs and Layer-2 switches require a 48-bit Destination MAC address—and discovering that MAC address is the job of ARP.

Defined in IETF RFC 826 (An Ethernet Address Resolution Protocol, David C. Plummer, 1982), ARP (Address Resolution Protocol) bridges the gap between Layer-3 logical IPv4 addressing and Layer-2 physical Ethernet MAC addressing.

When an application or diagnostic utility (such as ping 192.168.1.20 or ping 10.0.0.10) creates an IPv4 packet, the host operating system knows the Source IP and Destination IP. However, to encapsulate that IPv4 packet into an Ethernet II frame for transmission onto the wire, the host must fill in the Destination MAC address field.

In this guide, we examine the exact decision flow a host executes before sending an ARP Request, the difference between same-subnet ARP and foreign-subnet (Default Gateway) ARP, the structure of ARP Request and ARP Reply frames, and how to watch ARP resolution hop-by-hop in the Web Packet Tracer & Network Simulator.

1. Local vs. Remote Subnet Decision: Who Does the Host ARP For?

One of the most frequently tested concepts on the Cisco CCNA (200-301) exam is how a host decides which IPv4 address to query via ARP.

Before sending a single frame, the sending host performs a bitwise AND comparison using its own IPv4 Address, its Subnet Mask, and the Destination IPv4 Address (you can calculate and verify any subnet boundary using the IPv4 Subnet Calculator):

Host IPv4:   192.168.1.10  AND  255.255.255.0  =  192.168.1.0 (Local Network ID)
Target IPv4: Dst_IP        AND  255.255.255.0  =  Target Network ID

This comparison yields two possible outcomes:

Case A: Destination IP Is in the SAME Subnet (Local Communication)

Example: PC1 (192.168.1.10/24) wants to send a packet to PC3 (192.168.1.50/24).
Both addresses mask to 192.168.1.0/24.
Next-Hop IP: The destination host itself (192.168.1.50).
ARP Target IP: PC1 checks its ARP cache for 192.168.1.50. If missing, PC1 broadcasts an ARP Request asking: "Who has 192.168.1.50? Tell 192.168.1.10." The default gateway router is never involved.

Case B: Destination IP Is in a DIFFERENT Subnet (Remote Communication)

Example: PC1 (192.168.1.10/24, Default Gateway 192.168.1.1) wants to send a packet to PC2 (10.0.0.10/24).
10.0.0.10 AND 255.255.255.0 = 10.0.0.0, which does not match 192.168.1.0.
Next-Hop IP: PC1's configured Default Gateway (192.168.1.1).
ARP Target IP: PC1 checks its ARP cache for 192.168.1.1 (its default gateway)—NOT 10.0.0.10!
Why? Because ARP is a Layer-2 broadcast (FF:FF:FF:FF:FF:FF), and routers do not forward Layer-2 broadcasts across subnets. Therefore, PC1 resolves the MAC address of its local default gateway (R1 Gi0/0), addresses the Layer-2 Ethernet frame to R1's MAC address, and places 10.0.0.10 inside the Layer-3 Destination IP field.

2. Inside the ARP Request (Broadcast) & ARP Reply (Unicast)

When a host or router needs to resolve a next-hop IPv4 address that is not in its ARP table, it holds (enqueues) the waiting IPv4 packet in a buffer and transmits an ARP Request encapsulated directly inside an Ethernet frame with EtherType 0x0806:

Field	ARP Request (Operation `1`)	ARP Reply (Operation `2`)
L2 Ethernet Destination MAC	`FF:FF:FF:FF:FF:FF` (Broadcast)	Sender's MAC (`02:00:00:00:00:01`) (Unicast)
L2 Ethernet Source MAC	Sender's MAC (`02:00:00:00:00:01`)	Target's MAC (`02:00:00:00:00:03`)
L2 EtherType	`0x0806` (ARP)	`0x0806` (ARP)
ARP Opcode	`1` (Request)	`2` (Reply)
Sender Hardware Address (SHA)	Sender's MAC (`02:00:00:00:00:01`)	Responder's MAC (`02:00:00:00:00:03`)
Sender Protocol Address (SPA)	Sender's IP (`192.168.1.10`)	Responder's IP (`192.168.1.1`)
Target Hardware Address (THA)	`00:00:00:00:00:00` (Unknown / Zeroed)	Original Sender's MAC (`02:00:00:00:00:01`)
Target Protocol Address (TPA)	Target IP being queried (`192.168.1.1`)	Original Sender's IP (`192.168.1.10`)

Opportunistic ARP Learning

Per RFC 826, when the target device (192.168.1.1) receives the ARP Request addressed to its own IP, it immediately records the requester's Sender IP -> Sender MAC (192.168.1.10 -> 02:00:00:00:00:01) into its own ARP table before transmitting the unicast ARP Reply. That way, the target device does not need to send another ARP Request when replying!

3. Why the First Ping Probe Often Times Out (`!....` or `.!!!!`)

On physical Cisco routers and in network simulators, when you ping a host across one or more routers for the very first time, you will often see the first ICMP probe fail with a dot (.) followed by four exclamation marks (.!!!! — 80% success rate), and then !!!!! (100% success rate) on the second ping command.

Why does that happen?

When the first ICMP Echo Request arrives at a router whose ARP cache does not yet have the destination host's MAC address, the router must send an ARP Request on the egress LAN.
On real Cisco IOS hardware (and many simulators), while ARP resolution is incomplete, either the first packet is dropped while initiating ARP or the cumulative multi-hop ARP delay exceeds the 2-second ICMP echo timeout.
Once the ARP Reply populates the ARP table, probes 2 through 5 are forwarded immediately at wire speed.

(Note: In the BrainyTools Web Packet Tracer, each device's ARP table includes a waiting packet queue via arp.enqueue(), so when the ARP Reply arrives within the 3200ms ARP timeout, the queued ICMP Echo Request is immediately transmitted!)

4. Hands-On Lab: Inspecting ARP Tables on PCs and Cisco Routers

Open the Web Packet Tracer & Network Simulator and follow these steps:

Click Load Sample Topology (PC1 $\rightarrow$ SW1 $\rightarrow$ R1 $\rightarrow$ SW2 $\rightarrow$ PC2).
Select the PC1 console tab and inspect its initial ARP table:
```
C:\> arp -a
No ARP Entries Found.
```

Select the R1 console tab and inspect the router's initial ARP table:

R1> enable
R1# show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.1      -          02:00:00:00:00:03  ARPA   GigabitEthernet0/0
Internet  10.0.0.1         -          02:00:00:00:00:04  ARPA   GigabitEthernet0/1

Notice that a Cisco router lists its own active interface IP-to-MAC mappings with an Age of - (hyphen), while dynamically learned neighbor ARP entries show a numeric age in minutes (0).

Switch back to PC1 and run:
```
C:\> ping 10.0.0.10
```
Check the Packet Trace Event Log on the right side of the canvas:
- First, PC1 emits ARP who-has 192.168.1.1 tell 192.168.1.10 (amber badge).
- R1 replies ARP reply 192.168.1.1 is-at ....
- PC1 transmits ICMP echo-request 192.168.1.10 -> 10.0.0.10 ttl=128 seq=1 (indigo badge).
- R1 decrements TTL to 127, sees it does not yet have 10.0.0.10 in its ARP table, emits ARP who-has 10.0.0.10 tell 10.0.0.1 on Gi0/1, receives PC2's ARP reply, and delivers the ICMP Echo Request!
Now re-run arp -a on PC1 and show arp on R1:
- PC1's ARP table lists 192.168.1.1 (its default gateway)—not 10.0.0.10!
- R1's ARP table now lists both 192.168.1.10 and 10.0.0.10.
- You can clear the ARP cache at any time using arp -d on a PC or clear arp in Privileged EXEC mode on a router.

5. Legitimate Sources & Standards References

IETF RFC 826 (STD 37): An Ethernet Address Resolution Protocol: Or Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet Hardware (D. C. Plummer, November 1982).
IETF RFC 1122: Requirements for Internet Hosts — Communication Layers (Section 2.3.2: Address Resolution Protocol — ARP).
Cisco IOS IP Addressing Services Command Reference: show arp, show ip arp, and clear arp-cache documentation.
Cisco CCNA 200-301 Exam Topics (v1.1): Domain 1.0 & 2.0 (ARP operation, local vs. default gateway address resolution).

6. CCNA 200-301 Exam Prep: Questions & Detailed Answers

Question 1

PC1 is configured with IP address 192.168.10.25/24 and default gateway 192.168.10.1. PC1 needs to send a packet to a server at 192.168.20.50. Assuming PC1's ARP cache is currently empty, what Target IP address and what Destination MAC address will PC1 place in its ARP Request?

A. Target IP = 192.168.20.50; Destination MAC = FF:FF:FF:FF:FF:FF
B. Target IP = 192.168.10.1; Destination MAC = FF:FF:FF:FF:FF:FF
C. Target IP = 192.168.10.1; Destination MAC = 00:00:00:00:00:00
D. Target IP = 192.168.20.50; Destination MAC = Default Gateway's MAC

Correct Answer: B
Explanation: Because 192.168.20.50 is in a different subnet from 192.168.10.25/24, PC1 must send the packet via its default gateway (192.168.10.1). Therefore, PC1 sends an ARP Request for the Target IP 192.168.10.1. In the outer Layer-2 Ethernet header, the Destination MAC address of an ARP Request is always the broadcast MAC FF:FF:FF:FF:FF:FF (while the Target Hardware Address field inside the ARP payload is set to 00:00:00:00:00:00).

Question 2

How are an ARP Request and an ARP Reply transmitted at Layer 2 on an Ethernet LAN?

A. Both ARP Request and ARP Reply are broadcast (FF:FF:FF:FF:FF:FF).
B. ARP Request is unicast; ARP Reply is broadcast.
C. ARP Request is broadcast (FF:FF:FF:FF:FF:FF); ARP Reply is unicast to the requester's MAC address.
D. ARP Request is multicast (01:00:5E:00:00:01); ARP Reply is unicast.

Correct Answer: C
Explanation: Because the sender does not know the target's MAC address, the ARP Request is sent to the Layer-2 Ethernet broadcast address (FF:FF:FF:FF:FF:FF) so every device in the broadcast domain receives it. Because the ARP Request contains the sender's MAC and IP address, the target device replies with a unicast ARP Reply addressed directly to the sender's MAC.

Question 3

In the output of show ip arp (or show arp) on a Cisco IOS router, what does a hyphen (-) in the Age (min) column indicate?

A. The ARP entry has expired and is waiting to be flushed.
B. The entry belongs to one of the router's own local interface IPv4/MAC addresses and does not age out.
C. The entry was learned less than 60 seconds ago.
D. The neighbor device failed to respond to an ARP Request.

Correct Answer: B
Explanation: On a Cisco IOS router, the router's own active interface IPv4 addresses and burned-in MAC addresses are listed in the ARP table with an Age of - (hyphen) because they are local to the router and never expire. Dynamically learned neighbor entries show an integer age in minutes starting at 0.

Question 4

What happens when a Layer-3 router receives an Ethernet broadcast ARP Request (Destination MAC: FF:FF:FF:FF:FF:FF) on Gi0/0 asking for an IP address that belongs to a host on another subnet (Gi0/1) (assuming Proxy ARP is disabled)?

A. The router floods the ARP Request out of Gi0/1.
B. The router drops the ARP Request and does not forward Layer-2 broadcasts across interfaces.
C. The router encapsulates the ARP Request inside an ICMP packet and routes it.
D. The router updates its routing table with the sender's MAC address.

Correct Answer: B
Explanation: Routers terminate Layer-2 broadcast domains. When a router receives an ARP Request on Gi0/0, it inspects the Target Protocol Address (TPA). If the TPA does not match Gi0/0's IP address (and Proxy ARP is disabled), the router discards the frame—it never forwards Layer-2 Ethernet broadcasts out of other router interfaces.

Question 5

Which command displays the ARP cache on a Windows / PC command prompt, and which command displays it on a Cisco IOS router?

A. PC: show arp; Router: ipconfig /arp
B. PC: arp -a; Router: show arp (or show ip arp)
C. PC: arp --list; Router: show mac address-table
D. PC: tracert -a; Router: show ip route arp

Correct Answer: B
Explanation: On a Windows/PC command prompt, arp -a displays the IPv4-to-Physical (MAC) address translation table (and arp -d clears it). On a Cisco IOS router in Privileged EXEC mode, show arp or show ip arp displays the ARP cache.