Basics of networking

As network users, when we transfer data from one device to another, we know the IP address or domain name of the device, so we can perform such transfers. Even worse are MAC addresses, on the basis of which we network users do not determine the recipient of the data, this happens outside of us. In IPv4-based computer networks, a protocol called ARP (Address Resolution Protocol) is used to obtain information about the MAC address of a particular device.

ARP is a mechanism that allows logical (i.e. IP) addresses to be mapped to physical (i.e. MAC) addresses. Suppose a computer that wants to send data to another device knows its IP address, but does not know its MAC address. To know this address, the computer sending the data will create an ARP broadcast frame and broadcast it to all devices on the same network before sending the specified data. The source address field of the frame stores the address of the computer that prepared the frame and the destination address field stores the broadcast MAC address: FF-FF-FF-FF-FF-FF.

Each device that receives a frame decapsulates it into a packet and checks that the IP address of the destination field is its address. If the destination IP address is not its own, it will ignore the packet; if it is its IP address, it will create a new frame storing its MAC address and send it for transmission.

The computer sending the broadcast frame now knows the physical address of the device it wants to communicate with and can start that communication. IP to MAC mapping information is stored in each device's ARP table for later use. By default on Windows systems, such entries last up to 10 minutes and are then deleted. To view the ARP table, run arp -a from the console. As you can see, there are several entries here, which means that there has been communication between my computer and another device in the last 10 minutes.