Skip to content

MAC Addresses & ARP

MAC Addresses

A MAC (Media Access Control) address is a 48-bit hardware address burned into a network interface, written as 6 hex octets:

AC:DE:48:00:11:22
  • First 3 octets (AC:DE:48) — the OUI (Organizationally Unique Identifier), assigned to the manufacturer
  • Last 3 octets (00:11:22) — unique to that specific interface

MAC addresses operate at Layer 2 and only have meaning within a single broadcast domain — they never cross a router. This is the Layer 2 counterpart to the Layer 3 IP addressing covered in IP Subnetting.

How Switches Learn MAC Addresses

A switch builds a MAC address table (also called a CAM table — Content Addressable Memory) by watching the source MAC address of every frame it receives on each port:

  1. Frame arrives on Gi0/1 with source MAC AC:DE:48:00:11:22
  2. Switch records: "AC:DE:48:00:11:22 is out Gi0/1"
  3. Future frames destined for that MAC are forwarded only out Gi0/1, instead of flooding every port

If the destination MAC isn't yet in the table, the switch floods the frame out every port in that VLAN except the one it arrived on (this is why Port Security matters — an attacker flooding fake source MACs can exhaust the table and force the switch into flooding everything, defeating the point of switching).

Cisco IOS — privileged EXEC (also works from user EXEC):

! View the full MAC address table
show mac address-table
! MACs learned on a specific port
show mac address-table interface Gi0/1
! Find which port a specific known device (Dante interface, lighting
! node, console) is plugged into — IOS wants the MAC in dotted format,
! so AC:DE:48:00:11:22 is typed as acde.4800.1122
show mac address-table address acde.4800.1122

ARP (Address Resolution Protocol)

ARP resolves an IP address to the MAC address needed to actually deliver a frame on the local segment — IP routing gets a packet to the right subnet, but Layer 2 delivery still needs a MAC address.

ARP Request/Reply

  1. Host A wants to reach 10.0.10.5 but only knows the IP, not the MAC
  2. Host A broadcasts an ARP request: "Who has 10.0.10.5? Tell 10.0.10.1" (sent to the broadcast MAC FF:FF:FF:FF:FF:FF, so every device on the segment receives it)
  3. The device with that IP replies directly (unicast) with an ARP reply containing its MAC address
  4. Host A caches the result in its ARP table and uses it for subsequent frames

Cisco IOS — privileged EXEC (also works from user EXEC):

! View the switch/router's ARP table (IP-to-MAC mappings)
show arp

Note: an ARP table only contains IPs that device has itself talked to — on a switch doing pure Layer 2, that's little more than its management interface's peers, not a map of the whole segment. To find which MAC has an unknown IP LAN-wide, check the gateway's table — on the Netgate: pfSense web GUI, Diagnostics > ARP Table — then feed that MAC into show mac address-table address on the switch to find the physical port.

Gratuitous ARP

A device can broadcast an unsolicited ARP message for its own IP (a "gratuitous ARP" — sent as a broadcast ARP request or, in some implementations, a broadcast reply). It's used to announce a new IP or update other devices' stale ARP caches after a failover (pfSense CARP does this). Detecting IP conflicts uses the request form: broadcast an ARP request for your own IP, and if a reply comes back, that IP is already in use.

ARP Spoofing

Because ARP has no built-in authentication, a malicious device can reply to ARP requests it wasn't asked to answer, claiming to own an IP it doesn't — redirecting traffic through itself (a classic man-in-the-middle technique). This is exactly what Dynamic ARP Inspection is built to prevent, by validating ARP replies against the DHCP snooping binding table.

Stale ARP Entries

ARP caches expire on their own, but not instantly — after re-IPing a device, the old IP-to-MAC entry can linger on the gateway or a laptop for minutes, making the re-addressed device look unreachable. If a freshly re-addressed device won't respond, flush the caches:

Cisco IOS — privileged EXEC:

! Flush the switch/router's ARP cache
clear arp-cache

Windows / macOS shell (elevated / sudo):

# View the local ARP table
arp -a
# Delete the stale entry for one IP
arp -d 10.0.10.5

On the Netgate, Diagnostics > ARP Table in the pfSense web GUI has a per-entry delete.