Part I · How it works
6.5 Ethernet, MAC addresses and ARP
alsomac addressmacethernetarpneighbourneighborip neighswitchlayer 2
TL;DR
- On a local network, frames travel from MAC address to MAC address:
48-bit hardware addresses such as
f4:92:bf:0e:21:7a. - To reach an IP address on the same network, a machine asks "who has this IP?" (ARP) and keeps the answer in its neighbour table.
- A switch learns which MAC address sits behind each port and sends frames only there; Wi-Fi does the same through the access point.
ip neigh # the neighbour (ARP) table
ip -br link # your MAC addresses
On your machine
$ atfq 6.5 L2 link wlp0s20f3 up · neighbour 192.168.1.1 is f4:92:bf:0e:21:7a on wlp0s20f3 L3 IP docker0 172.17.0.1/16, wlp0s20f3 192.168.1.23/24, wlp0s20f3 fe80::8ec6:81ff:fe2a:107f/64 · gateway 192.168.1.1 · forwards packets for others L4 TCP 12 connections open now; 30,120 started and 410 accepted since boot · 1,840 of 3.1 million segments resent L4 UDP 95,000 datagrams in, 61,000 out, since boot L7 DNS 127.0.0.53
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- Phones and laptops often use a random MAC address per Wi-Fi network, for privacy: a router may list the same device twice.
- Two machines answering ARP for one address, by mistake or as an attack, make connections drop on and off.
- IPv6 doesn't use ARP: neighbour discovery (NDP) does the same job, with ICMPv6.
Deep dive 2 questions
What's in a MAC address?
Six bytes. The first three often name the manufacturer, the rest the
device. One bit of the first byte marks "locally administered" addresses,
which is what random MAC addresses set. ff:ff:ff:ff:ff:ff is broadcast:
every machine on the link reads it.
Why both MAC and IP addresses?
IP addresses are logical: they depend on the network you join, and they carry a packet across many networks. MAC addresses deliver it on the current link, one hop at a time. At each router, the IP addresses stay the same while the MAC addresses change.