Networking / Basic: packet paths and addressing / Lesson 3

Explain Ethernet switching and ARP delivery

Follow local frames, learned forwarding entries, broadcasts, and IPv4 neighbor resolution without confusing them with routed reachability or authentication.

About 4 min readContent reviewed 2026-10-25

On this page

Lesson goals

Distinguish switch learning from address resolution.
Explain ARP for a selected on-link next hop.
Recognize broadcast-domain and stale-neighbor failure clues.

A switch learns from source addresses

A conventional Ethernet switch learns which source MAC addresses arrive on which ports within its forwarding context. It uses destination MAC information to select an outgoing port when an entry is known. Unknown unicast and broadcast traffic can be flooded within the relevant domain under the device’s rules. This learning process is separate from IP routing and from ARP. A forwarding-table entry does not prove an endpoint is currently healthy or authorized. Aging, movement, topology changes, and virtualization can alter the table, so an old observation should not become a permanent topology assumption.

ARP resolves a local IPv4 neighbor

After routing selects an on-link destination or next hop, ARP can discover the corresponding Ethernet address. The request asks about a protocol address on the local link; the reply supplies a mapping. For an off-link server, the host commonly resolves its router’s address rather than the server’s. ARP does not authenticate the mapping and does not provide end-to-end encryption. Static-looking cached data may also be stale. Keep the selected IP next hop, local interface, VLAN or domain, and mapping lifetime together when explaining why a frame went to a particular destination MAC.

python Separate next-hop MAC from remote IP

neighbors = {'192.0.2.1': '02:00:00:00:00:01'}
next_hop = '192.0.2.1'
print('frame_destination=' + neighbors[next_hop])
print('ip_destination=198.51.100.20')

Expected output

frame_destination=02:00:00:00:00:01
ip_destination=198.51.100.20

This synthetic mapping dictionary models one lookup. It reads no neighbor cache and sends no ARP request; the remote IP remains distinct from the frame recipient.

Broadcast reach follows the link design

A broadcast domain defines where a local broadcast can be delivered, not which applications may communicate end to end. VLANs commonly separate Ethernet forwarding domains, while routing connects selected networks. A VLAN number is meaningful only in the configured context; equal numbers on disconnected systems do not create a link. Loops in a layer-two topology need a deliberate prevention or control design, because flooded traffic can circulate and multiply. This lesson does not configure switches or spanning-tree behavior. It teaches why a missing local request and a missing routed return are different questions.

A neighbor record has state and age

A learned mapping is an observation with a lifetime, not a guarantee that the peer still occupies the same attachment point. Duplicate addresses, migration, changed virtual interfaces, and stale caches can all produce confusing symptoms. Record the direction and time before calling a mapping wrong. A host may receive a request but be unable to return through the expected path. Offline fixtures can check whether an explanation is internally consistent, but they cannot prove what a real switch or endpoint did. Preserve that limitation rather than inventing packet results.

python Check a declared local-resolution event fixture

events = [('request', '192.0.2.1'), ('reply', '192.0.2.1'), ('data', '198.51.100.20')]
resolved = {address for kind, address in events if kind == 'reply'}
print('router_mapping_observed=' + str('192.0.2.1' in resolved))
print('remote_mapping_observed=' + str('198.51.100.20' in resolved))

Expected output

router_mapping_observed=True
remote_mapping_observed=False

The fixture records a router reply and no remote ARP reply. The result tests the model only; it is not a capture or a claim about any deployed network.

Choose the correct local question first

Before blaming ARP, determine whether the selected next hop should be local and whether the sender’s prefix and route agree with that decision. Before blaming a switch, separate IP-address configuration from source-MAC learning. A wrong subnet mask can make a host attempt direct resolution for an address that should use a router. A policy boundary can also prevent higher-layer traffic after local delivery succeeds. Build a short evidence chain from route decision to neighbor mapping to frame delivery, and stop each inference at what its observation actually supports. No live inspection or network change is performed here.

Common errors and fixes

Switch learning is called ARP learning

Why it happens: MAC forwarding and IP-to-MAC resolution were conflated.
How to fix it: Name each table and its key separately.
Prevent it next time: Draw layer-two and layer-three decisions independently.

A cached mapping is assumed authenticated

Why it happens: Reachability data was confused with trust.
How to fix it: Use appropriate authenticated higher-layer protocols.
Prevent it next time: Treat neighbor data as untrusted operational state.

A remote address is resolved directly on the LAN

Why it happens: An incorrect prefix or route changed on-link classification.
How to fix it: Review addressing and next-hop selection first.
Prevent it next time: Test address-plan consistency offline.

Check your understanding

1. Why can a router’s MAC appear in frames carrying a different server IP?

Show worked solution

The router is the local next hop for an off-link destination. Ethernet delivers the frame to that router, while the IP destination identifies the remote endpoint. These are different layer responsibilities rather than contradictory addresses.

2. What does a source-MAC entry in a switch prove?