Ethernet, MAC & ARP

Published on:

Most important commands to remember

  • ip link — inspect network interfaces and their MAC addresses.
  • ip -4 neigh — inspect IPv4 neighbors and their link-layer addresses.

Commands and flags

These commands appear in the short example below.

Command Meaning
ip -br link show Show interfaces, link states, and link-layer addresses. -br selects a brief display.
ip -4 neigh show Show the IPv4 neighbor table. -4 selects IPv4; neigh means neighbor.

Both commands inspect existing state. They do not change interfaces, clear cached neighbors, or generate a test exchange.

The concepts that matter

1. Ethernet delivers frames across a local network

An IP packet carries traffic toward an IP destination. On an Ethernet link, that packet travels inside an Ethernet frame, which has its own source and destination addresses.

Think of two questions: IP identifies the destination across networks; Ethernet delivers the frame to the next interface on this local network. That local network can include switches, not just one cable.

An Ethernet MAC address is normally 48 bits, written as six hexadecimal pairs, such as 02:42:ac:11:00:02. A frame uses MAC addresses for local delivery. A switch learns source MAC addresses to decide where to forward frames.

A MAC address is not an IP address or a permanent identity for a whole computer. A machine can have several interfaces, and MAC addresses can be configured or randomized.

Routers forward IP packets between networks. When forwarding onto another Ethernet link, they use a new Ethernet header for that link. The original client’s MAC address does not travel all the way to a remote website as the packet’s Ethernet source.

3. ARP finds the MAC address of the next hop

ARP (Address Resolution Protocol) resolves an IPv4 address to a link-layer address on the local network.

For initial discovery on Ethernet, a host normally broadcasts a request: “Who has this IPv4 address?” The owner replies with its MAC address. Linux can then address the outgoing frame. The Ethernet broadcast address is ff:ff:ff:ff:ff:ff.

Which IPv4 address does it ask about? The route decides. For a directly connected destination, it asks about that destination. For a remote destination reached through a router, it asks about the router’s local address. The IP packet still names the remote destination, while the frame names the local next hop.

ARP does not discover the remote server’s MAC across routers, and it does not resolve website names. Name resolution is a separate job.

4. The neighbor table is a cache, not a health check

Linux keeps learned mappings in its neighbor table, so every packet does not require a fresh ARP exchange.

  • REACHABLE: the neighbor’s reachability was recently confirmed.
  • STALE: the mapping is known, but reachability needs reconfirmation when used. This is not automatically a failure.
  • INCOMPLETE / FAILED: resolution is in progress or failed to resolve the neighbor.

A valid mapping supports local delivery. It does not prove that a remote route works or an application is answering requests.

One small example

Optional: run these commands in a Linux terminal with iproute2 installed. No administrator access is needed:

ip -br link show
ip -4 neigh show

In the first output, identify an Ethernet interface and its MAC address. lo is loopback, not an Ethernet neighbor. Interface names and addresses vary; virtual interfaces can report states such as UNKNOWN, so the state alone is not an end-to-end connectivity test.

In the neighbor output, read the IPv4 address, dev (local interface), lladdr (neighbor’s link-layer address), and state. The neighbor’s MAC belongs to the next hop, while the first command shows your own interfaces’ addresses. Entries undergoing resolution may have no lladdr yet.

An empty table is valid if no IPv4 neighbors are currently cached. This example reads the cache; it does not capture an ARP request or prove that an exchange just happened. Nothing needs cleanup.

Keep this idea: routing chooses the next hop; ARP finds its local MAC address; Ethernet delivers the frame there.