When a network device updates its MAC table, what protocol is being called?

I am pretty sure it is ARP, but correct me if I am wrong!

What messages are being sent and from whom, what information is being exchanged, and why?

  • 1
    It depends what exactly you mean by "network device". Could it be that you confuse the MAC table (layer 2) with the ARP table (layer 3)? (see answer for more details)
    – Albin
    Oct 4 '20 at 12:34

It depends what exactly you mean by "network device". Could it be that you confuse the MAC table (layer 2) with the ARP table (layer 3)?

Usually if you talk about MAC tables you are referring to switches. If a switch doesn't know the destination MAC address (no entry in the MAC table) it will send out a frame on all ports (except the source port) acting like a hub, but this "discovery" is not ARP. In fact it's not a "discovery" at all, the switch does not learn the destination MAC until it receives a frame from that device.

The ARP protocol or subsequently the ARP table is used to resolve an IP address to the corresponding MAC address. For example if my PC's NIC has the IP and I want to ping the ARP table (not the MAC table) will be used to check the corresponding MAC address.

If the table does not have an entry for this IP the ARP protocol is used to "discover" the corresponding MAC address. For that an ARP request (that includes the target IP address as well as the source MAC and source IP) is send out to the broadcast MAC address (ff-ff-ff-ff-ff-ff), the switch will send the request to all active ports. If a device connected to the switch recognizes the target IP as it's own IP address it will send back an ARP response with it's MAC address back to the source IP/MAC.

Note1: the frames arriving at the switch from ARP request and response will be used to populate the switch's MAC table.

Note2: Unless we are talking about level 3 switches, those use ARP as well.


Yes, you are right that's ARP.

ARP stands for Address Resolution Protocol. When you try to ping an IP address on your local network, say, your system has to turn the IP address into a MAC address. This involves using ARP to resolve the address, hence its name.

Systems keep an ARP look-up table where they store information about what IP addresses are associated with what MAC addresses. When trying to send a packet to an IP address, the system will first consult this table to see if it already knows the MAC address. If there is a value cached, ARP is not used.

If the IP address is not found in the ARP table, the system will then send a broadcast packet to the network using the ARP protocol to ask "who has". Because it is a broadcast packet, it is sent to a special MAC address that causes all machines on the network to receive it. Any machine with the requested IP address will reply with an ARP packet that says "I am", and this includes the MAC address which can receive packets for that IP.

Source: https://www.tummy.com/articles/networking-basics-how-arp-works/

  • ARP is not used to populate the MAC table, it is used to populate the ARP table!
    – Albin
    Oct 3 '20 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.