When an IPv4 host wants to send traffic to another address on the same local subnet, Ethernet ultimately needs a destination MAC address. Address Resolution Protocol (ARP) fills that gap. The sender broadcasts a request asking which device owns a particular IPv4 address; the owner replies with its link-layer address, and the mapping is cached for a period of time. For off-subnet traffic, the client resolves the default gateway’s MAC rather than the remote internet server’s MAC.

ARP maps a local IPv4 next hop to a MAC address

This local-only behavior is why a device can know the IP of a website but never ARP for the website itself. Routing logic first decides whether the destination is local. If it is remote, Ethernet frames go to the router’s MAC while the IP packet keeps the remote destination IP. ARP therefore sits at an important boundary between IP addressing and the local link.

Resolving the gateway before sending off-LAN traffic

A PC at 192.168.1.20 wants to reach 8.8.8.8. Its subnet mask says that destination is remote, so the PC does not ask “who has 8.8.8.8?” It ARPs for 192.168.1.1, sends the Ethernet frame to the router’s MAC, and the router forwards the IP packet toward the internet.

Inspect neighbors and verify the destination subnet

  • Use the ARP/neighbor table to see which MAC address the client currently associates with the gateway or local peer.
  • If a gateway ping fails, verify an ARP entry is learned; no entry can point to VLAN, subnet, isolation, cabling, or local-link problems.
  • Watch for the same IP appearing with different MAC addresses over time, which can indicate a duplicate address or topology change.
  • Clear a stale neighbor entry only as a controlled test; the host should relearn it automatically.
  • Remember that routers do not forward ordinary ARP broadcasts between subnets.
  • On IPv6, Neighbor Discovery replaces ARP with ICMPv6-based mechanisms.

Broadcast domains, caches and duplicate addresses

ARP has no built-in authentication, which is why hostile networks can abuse spoofed ARP messages. Home users should not interpret every changing ARP entry as an attack, however: phones use different interfaces, mesh systems can proxy/bridge traffic, virtualization can move addresses, and legitimate failover can change the MAC associated with an IP. Context and network ownership matter.

Avoid expecting ARP to discover internet hosts

  • Thinking ARP translates domain names to IP addresses—that is DNS.
  • Expecting ARP to resolve an internet server across the router.
  • Assuming a stale ARP cache is the root cause of every local connection failure.
  • Ignoring duplicate static IP configuration when two devices claim the same address.

Is ARP used for DNS?

No. DNS maps names to IP addresses; ARP maps local IPv4 addresses to link-layer addresses.

Why does the gateway have a MAC in my ARP table?

Because your device sends off-subnet IPv4 traffic to the gateway at layer 2.

Can ARP cross a router?

Normal ARP broadcasts stay within a local broadcast domain. Proxy ARP is a special behavior, not the default expectation.

What replaces ARP in IPv6?

IPv6 Neighbor Discovery uses ICMPv6 messages for neighbor and router discovery.

Technical references

Video walkthrough for ARP Explained: How IPv4 Devices Find the MAC Address Behind a Local IP

Explains how MAC addresses differ from IP addresses and why local-network identity is not the same as a routable address. Modern private/randomized MAC features can intentionally change the address seen by a Wi-Fi network.