Broadcast request → unicast reply → cache update, step by step
This simulator animates the Address Resolution Protocol (ARP) step by step: a host with a packet to send but no cached MAC address broadcasts an ARP Request to every device on the local segment, the target host replies with a unicast ARP Reply carrying its MAC address, and the requester caches the mapping for future use. It is one of the most fundamental Layer 2/Layer 3 handoffs in any Ethernet network.
Before a host can send an IP packet to another host on the same subnet, it must know the destination MAC address to build the Ethernet frame header. The host first checks its local ARP cache; on a miss, it broadcasts an ARP Request (EtherType 0x0806, Dst MAC FF:FF:FF:FF:FF:FF) asking "who has this IP?" Every device on the broadcast domain receives the frame, but only the host whose IP matches the Target Protocol Address replies — with a unicast ARP Reply containing its MAC address. The requester caches this mapping and uses it for all subsequent frames until the entry ages out.
A Layer 2 switch has no visibility into ARP's IP-layer content — it treats the ARP Request purely as an Ethernet frame. Because the destination is a broadcast address, the switch floods it out every port except the one it arrived on, while simultaneously performing source-MAC learning to record where the sender lives. The reply, by contrast, is unicast, so the switch forwards it out a single learned port only — this is why the reply step is far more efficient than the request step.
ARP failures manifest as "destination host unreachable" or intermittent connectivity even when routing and DNS are correct. Common causes include ARP cache poisoning (a security attack where a malicious host replies with a forged mapping), VLAN misconfiguration (ARP cannot cross broadcast domains without a router), and stale cache entries after a NIC or IP change. Tools like arp -a (Windows/Linux) or show ip arp (Cisco) let engineers inspect the live cache this simulator is modeling.
The requester does not yet know which host holds the target IP, so it must ask everyone — hence a broadcast. Once the target host identifies itself, it already knows the requester's MAC (from the request frame itself) and can reply directly, avoiding the overhead of a second broadcast.
No. ARP operates only within a single Layer 2 broadcast domain. To reach a host on a different subnet, a device instead ARPs for its default gateway's MAC address and lets the router handle Layer 3 forwarding from there.
A gratuitous ARP is an unsolicited ARP Request or Reply a host sends announcing its own IP-to-MAC mapping — typically after booting, changing its IP, or during a failover (e.g., HSRP/VRRP virtual MAC takeover). Other hosts on the segment update their caches proactively without having asked.
An attacker sends forged ARP Replies claiming to own an IP address (often the default gateway), causing victim hosts to cache the attacker's MAC instead of the real one. This redirects traffic through the attacker for man-in-the-middle interception — mitigated by Dynamic ARP Inspection (DAI) on managed switches.
Try our Enterprise IT Networks Studio
More calculators, simulators, and guides for this discipline.
Enterprise Wi-Fi Deployment Drawing Set (Full Access)
✨ Premium ContentA zoomable interactive reader — free preview, then unlock the full set.