Step 32. MAC Addresses and ARP — The Real Address on the Wire

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Step 31 (IP addresses) complete. We’ll work in Windows PowerShell. The only ping targets in this practice are your own home network (your gateway and your own devices).

What you need: A Windows PC and PowerShell.
Caution: Today’s practice is only lookups and short pings to your own gateway and your own devices, so it’s safe. Don’t aim exploratory commands at someone else’s network addresses — it’s like ringing a stranger’s doorbell without permission.

In the last chapter we learned addresses (IP). But something is odd. When my laptop sends data to the printer in the same neighborhood, that data travels over wires (or radio waves). Is the clump of data on the wire really labeled "to 172.30.1.54"?

In fact, no. The world on the wire has no such name as IP. There, the other party is called by the network card’s unique number — the MAC address. So how does a computer that only knows an IP find out the other party’s MAC? That bridge is today’s protagonist, ARP. And ARP has one fatal personality trait — it believes far too easily.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the difference between IP and MAC addresses from three perspectives (who assigns it, does it change, where is it used)
Draw ARP’s three stages (broadcast request → reply → cache record) as a diagram
Read the output of arp -a and Get-NetNeighbor, and distinguish dynamic from static entries
Demonstrate with an experiment how the ARP roster changes after a single ping
Explain that ARP has no verification step, and why that is the seed of danger

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language & environment	PowerShell 5.1 (lookups and ping only; regular privileges suffice)
Today’s commands	`ipconfig /all` (check my MAC), `arp -a` (ARP cache), `Get-NetNeighbor` (neighbor roster), `ping` (induce communication)
Concepts needed	MAC address, broadcast, ARP request/reply, ARP cache, OUI (vendor number)

2-1. Two Addresses — Why Bother with Two?

IP address: A logical address. It changes per neighborhood (network). Connect to a different network and you receive a new one. It’s for finding your way in the wide world (the internet).
MAC address (Media Access Control address): A physical address. A birth number engraved into the network card. It looks like 98-FD-B4-XX-XX-XX — six pairs of hexadecimal digits (48 bits).

The first three pairs of a MAC are the OUI (Organizationally Unique Identifier) — the vendor number. So just from the front of a MAC you can tell "ah, this is a Realtek network card." The last three pairs are a serial number the vendor assigns.

If IP is "an address borrowed from the neighborhood," MAC is "the network card’s birth number." One device carries both identities at once.

2-2. ARP — Asking by Neighborhood Broadcast

My computer wants to send data to 172.30.1.254 (the router). But on the wire, a MAC must be written. It doesn’t know it. What the computer does then is ARP (Address Resolution Protocol):

ARP request (broadcast): It shouts to the whole neighborhood: "Whoever is 172.30.1.254, tell me your MAC!" This shout goes to everyone in the neighborhood (a broadcast — that special address from Step 31 does its work here).
ARP reply: The router, which is 172.30.1.254, answers: "That’s me. My MAC is 60-29-d5-…"
Recorded in cache: My computer writes "172.30.1.254 = 60-29-d5-…" into a notepad (the ARP cache). From then on, no more shouting is needed.

arp -a is exactly the command that shows you that notepad.

2-3. A Packet’s Outer Envelope and Inner Letter — How the Two Addresses Cooperate

When data rides the wire, it’s actually an "envelope around a letter" structure. The outer envelope carries the MAC address; the letter paper carries the IP address.

[Outer envelope: MAC]  →  sender MAC: my network card / recipient MAC: the router
[Inner letter: IP]     →  sender IP: 172.30.1.54 / recipient IP: 142.251.118.101

Note this: even when I connect to a website in a faraway country, the recipient MAC on the outer envelope isn’t that site — it’s our neighborhood’s gatekeeper (the router). Because on the wire, only the router directly receives my data. The router opens the outer envelope, reads the IP on the letter, wraps it in a fresh envelope, and sends it to the next neighborhood.

Understand this picture and the answer to "why is ARP needed only within the same neighborhood" falls out. There’s no need to know another neighborhood’s MAC. You only need the gatekeeper’s MAC.

2-4. ARP’s Fatal Personality — There Is No Verification

Here’s where you should catch the scent of security. ARP has no procedure for confirming "is the one who answered really the owner of that address?" Shout "who is 172.30.1.254?" into the neighborhood, and it simply believes the voice that answers. It’s a protocol designed on the assumption of a neighborhood where everyone acts in good faith.

What if someone malicious answers, "I’m 172.30.1.254!"? The neighborhood’s data flows to them. That’s the principle of ARP spoofing, which you’ll learn later. Today’s goal stops at knowing this "structure of trust."

The reason a protocol with no verification is still in use is simple: it’s fast and convenient. The designers chose speed, and modern network equipment fills the resulting hole with separate monitoring features. The relationship between "the original protocol" and "reinforcement bolted on later" repeats across nearly every topic in security.

3. Follow Along

3-1. Checking My MAC Address

ipconfig /all

Ethernet adapter Ethernet:

   Description . . . . . . . . . . . : Realtek USB GbE Family Controller
   Physical Address. . . . . . . . . : 98-FD-B4-XX-XX-XX
   IPv4 Address. . . . . . . . . . . : 172.30.1.54(Preferred)

(Verified 2026-09-09. The MAC’s last three pairs are masked. Your values will differ.)

How to read the output: Physical Address is the MAC. Some operating systems write it with colons (:) instead of hyphens (-), but it’s the same thing. Check your two addresses side by side — IP (the address borrowed from the neighborhood) and MAC (the birth number). Search the first three pairs, 98-FD-B4, with an "OUI lookup" on the internet and the vendor comes up.

3-2. Viewing the Neighbor Roster — arp -a

arp -a

Interface: 172.30.1.54 --- 0x10
  Internet Address      Physical Address      Type
  172.30.1.6            a8-a1-59-XX-XX-XX     dynamic
  172.30.1.17           9c-6b-00-XX-XX-XX     dynamic
  172.30.1.35           a8-a1-59-XX-XX-XX     dynamic
  172.30.1.45           a8-a1-59-XX-XX-XX     dynamic
  172.30.1.53           a8-a1-59-XX-XX-XX     dynamic
  172.30.1.100          34-9f-7b-XX-XX-XX     dynamic
  172.30.1.254          60-29-d5-XX-XX-XX     dynamic
  172.30.1.255          ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-XX-XX-XX     static

(Verified 2026-09-09. Some lines omitted, and MAC tails are masked.)

How to read the output: This is the IP↔MAC correspondence table of neighbors my computer "knows." dynamic means learned via ARP; static means special addresses it always knew. ff-ff-ff-ff-ff-ff is the broadcast MAC meaning "everyone in the neighborhood," and ones starting with 01-00-5e-… are for group communication (multicast).

A pattern visible in the live capture: four MACs start with a8-a1-59 — meaning several devices from the same vendor are present (a common sight when smart-home devices share a brand). 172.30.1.254 at the bottom is our neighborhood gatekeeper, the router.

Why: This table is "the roster my computer currently trusts." When a spoofing attack succeeds, this table gets poisoned — and to distinguish normal from poisoned, you must know the table’s usual look. Knowing what normal looks like: that is a baseline.

3-3. The Same Roster, Another Face — Get-NetNeighbor

Get-NetNeighbor -AddressFamily IPv4 -State Reachable |
  Select-Object IPAddress, LinkLayerAddress, State

IPAddress    LinkLayerAddress   State
---------    ----------------   -----
172.30.1.254 60-29-D5-XX-XX-XX Reachable
172.30.1.65  9C-6B-00-XX-XX-XX Reachable
172.30.1.45  A8-A1-59-XX-XX-XX Reachable
172.30.1.37  0C-7A-15-XX-XX-XX Reachable
172.30.1.17  9C-6B-00-XX-XX-XX Reachable

(Verified 2026-09-09. MAC tails are masked.)

How to read the output: Get-NetNeighbor shows the same notepad together with a state. Reachable means "answered recently, so contactable." At the top, 172.30.1.254 — our neighborhood gatekeeper (the gateway) — is currently recorded as reachable. Other states include Stale (recorded, but not verified in a while) and Permanent (a permanent entry).

If the roster looks empty or sparse, that’s not a malfunction — records are erased when there’s been no conversation for a long time. You’ll confirm this right away in section 3-4.

3-4. Inducing Live ARP — Starting a Conversation with ping

ping -n 2 172.30.1.254

Pinging 172.30.1.254 with 32 bytes of data:
Reply from 172.30.1.254: bytes=32 time<1ms TTL=64
Reply from 172.30.1.254: bytes=32 time<1ms TTL=64

(Verified 2026-09-09. Replace the address with your own gateway. On Korean Windows, it appears in Korean, like "172.30.1.254의 응답: 바이트=32 …".)

How to read the output: ping is the command that asks "are you there?" time<1ms — same neighborhood, so it took less than a millisecond. For this communication to happen, my computer had to know the router’s MAC; if it didn’t, an ARP shout and answer passed back and forth just now.

Compare — same day, a ping sent far away:

ping -n 2 8.8.8.8

Reply from 8.8.8.8: bytes=32 time=33ms TTL=114

(Verified 2026-09-09.)

The time difference between the same neighborhood (0ms) and the far side of the internet (33ms) shows plainly. And even this distant ping went out with the router’s MAC on the outer envelope — nobody in our neighborhood knows 8.8.8.8’s MAC.

3-5. The Neighbor-Who-Doesn’t-Answer Experiment

This time, start a conversation with a number that doesn’t exist. Pick an address in your neighborhood that no device uses and ping it (the live capture chose 172.30.1.200):

ping -n 1 172.30.1.200

Pinging 172.30.1.200 with 32 bytes of data:
Reply from 172.30.1.54: Destination host unreachable.

(Verified 2026-09-09. On Korean Windows, it appears as something like "대상 호스트에 연결할 수 없습니다.")

How to read the output: Notice that the responder is myself (172.30.1.54). It’s not "the other party refused" — my computer is reporting on itself: "I shouted, but nobody answered, so I gave up on delivery." In other words, the ARP request rang out into empty air.

Next, check the roster:

arp -a | findstr 172.30.1.200

No line comes out. It shouted but got no answer, so there’s no record in the notepad either. Conversation creates the record — that is the essence of the ARP cache.

Make a prediction: Compare arp -a before and after pinging a device that’s actually on in the same neighborhood (a smartphone, a printer, etc.). What changes? Predict, then try it yourself. (Answer: on success, a new dynamic entry appears. Look again a few minutes to tens of minutes later and it may be gone — it’s normal for cache entries to be erased as they age.)

3-6. Organizing with a Diagram

On paper, draw the following sequence with arrows.

[My PC]  --(shout to the whole neighborhood)-->  "172.30.1.254, what's your MAC?"
[Router] --(answer just to me)---------------->  "That's me, 60-29-d5-…"
[My PC]  records it in the notepad (ARP cache) → all later traffic goes straight to that MAC

When you can draw this picture without looking at the book, you understand ARP. As a test, try explaining it out loud.

4. Missions & Exercises

Mission — Drawing My Neighborhood’s First Map

Check my MAC and my IP with ipconfig /all
Ping the gateway, then find the gateway’s MAC in arp -a
Ping one powered-on device in the same neighborhood (a smartphone, etc.) and check whether a new entry appears in the roster
Take the first three pairs of two or three MACs visible in the roster, search them with an "OUI lookup," and guess the vendors
Organize the results into lan-map.txt: my MAC, my IP, the gateway’s IP and MAC, the neighbor list and guessed vendors

Exercises

Question 1. Explain the difference between IP and MAC addresses from the three perspectives: "who assigns it, does it change, where is it used."

Question 2. Describe in three steps what happens when my computer sends data for the first time to 192.168.0.50 in the same neighborhood.

Question 3. When connecting to a website in a faraway country, whose MAC must my computer learn via ARP, and why?

Question 4. Using ARP’s structural weakness (no verification), explain what an attacker can do, and where the victim’s data flows as a result.

5. Model Answers & Completion Criteria

Mission Model Answer

The live-capture computer’s lan-map.txt example (2026-09-09, MACs partially masked):

My IP:           172.30.1.54/24
My MAC:          98-FD-B4-XX-XX-XX  (first three pairs 98-FD-B4 → vendor identifiable via OUI lookup)
Gateway:         172.30.1.254  →  MAC 60-29-D5-XX-XX-XX (dynamic)
Neighbors (dynamic): 172.30.1.6, .35, .45, .53 (all a8-a1-59-…, presumed same vendor)
Broadcast address:   172.30.1.255 → ff-ff-ff-ff-ff-ff (static, normal)

How to verify: ① Comparing arp -a before and after the ping, did a new dynamic entry appear? ② Is the gateway’s IP–MAC pair on the roster? ③ If you ever see two different IP lines sharing the same MAC, that’s when to ask questions ("one device pretending to be two addresses?") — saving today’s normal roster gives you something to compare against.

If no new line appeared: if the ping failed (section 3-5), no record is normal. A successful ping is the prerequisite.

Exercise Solutions

Question 1 solution. Who assigns it: IP is lent by the network (the DHCP server, usually the router); MAC is engraved into the chip by the manufacturer. Does it change: IP changes with every neighborhood you connect to; MAC is fixed in principle (though there are features that change the value software presents outward). Where it’s used: IP for wayfinding across the whole internet; MAC for the actual delivery within the same neighborhood.

Question 2 solution. ① Cache check: the ARP notepad is flipped through first. If there’s no entry, ② ARP request broadcast: "192.168.0.50, what’s your MAC?" is shouted to the whole neighborhood. ③ Reply received and recorded: when that device reports its MAC, it’s written into the cache, and the data is sent with that MAC on the outer envelope.

Question 3 solution. The router’s (gateway’s) MAC. Because on the wire, only the router directly receives my data and hands it on to the next neighborhood. There’s neither a need nor a way to know the website’s MAC — the outer envelope (MAC) is rewritten in each neighborhood, and only the inner letter (IP) survives to the end.

Question 4 solution. If an attacker gives a false reply of "I’m the gateway," the victim’s computer believes the answer without verification and writes it into its cache. From then on, all data meant for the gateway gets delivered to the attacker’s MAC — and since the attacker can peek at the contents and then forward it to the real router, the victim enters a state where the internet looks perfectly fine while every communication is being eavesdropped on (a man-in-the-middle attack). That is the picture of ARP spoofing.

Completion Criteria Checklist

[ ] I can explain the difference between IP and MAC from three perspectives
[ ] I can draw the flow of ARP request (broadcast) / reply / cache record as a diagram
[ ] I can read the output of arp -a and Get-NetNeighbor
[ ] I know the first three pairs of a MAC are the vendor number (OUI)
[ ] I confirmed by experiment that "a ping with no answer → no record in the roster"
[ ] I can explain that ARP is a structure of trust without verification, and that this is the seed of spoofing
[ ] Mission: I completed lan-map.txt (my neighborhood’s first map)

6. Common Pitfalls & Fixes

Wall 1. "arp -a shows too few neighbors. Is it broken?"

Symptom: There are clearly several devices in the same neighborhood, but the table has only a few lines.

Cause: The ARP cache is a notepad that holds only "parties I’ve talked with recently." Neighbors you’ve never conversed with were never recorded to begin with, and records are erased as they age.

Fix: It’s normal. If you want to see a neighbor, ping that address (start a conversation) and run arp -a again. The section 3-5 experiment is exactly that principle.

Wall 2. "ping says ‘Destination host unreachable.’"

Symptom: You pinged an address in the same neighborhood and got this message (verified live 2026-09-09):

Reply from 172.30.1.54: Destination host unreachable.

Cause: Look at who the responder is — not the other party but my own computer. It shouted via ARP, nobody answered, and it gave up on delivery. The other party is off, the address is an empty number, or a firewall is blocking the response.

Fix: Check that the address is correct and that the other party is on. This message is "no answer," not "refusal" — the two have different causes.

Wall 3. "It’s in the roster, but ping fails."

Symptom: The address is in arp -a, yet the ping fails.

Cause: The roster is merely a record of "answered at some point in the past" — not a guarantee of "alive right now." The other party may have turned off in the meantime.

Fix: Records are history; ping is the present. Read the two differently. This is exactly why aging cache entries get erased.

Wall 4. "I thought MAC addresses never change? But there’s a menu for changing them."

Symptom: You discover a "change MAC address" menu in router or OS settings.

Cause: You can’t change the birth number engraved in the chip, but the value the operating system "puts on the wire" can be changed.

Fix: Distinguish the two — the hardware’s real number and the number software claims. This distinction is later the key to understanding "attacks that defeat MAC address filtering."

Wall 5. "There are strange lines starting with 224 or 239 instead of 192.168."

Symptom: In arp -a, lines like 224.0.0.22 or 239.255.255.250 appear as static.

Cause: These are multicast addresses — a reserved range (224.0.0.0–239.255.255.255) for sending "to everyone in a specific group," with dedicated MACs starting 01-00-5e-… attached. It’s normal.

Fix: Know that these lines can be ignored. The habit of examining unfamiliar lines is good — just file this range under "normal."

7. Summary

Today’s Concepts

Concept	One-line description
MAC address	A network card’s unique number (48 bits, six hexadecimal pairs)
OUI	The MAC’s first three pairs — the vendor number
ARP	The "neighborhood broadcast" procedure that resolves IP → MAC
ARP cache	The notepad where learned correspondences are written (`arp -a`)
dynamic / static	Entries learned via ARP / entries reserved from the start
Broadcast MAC	ff-ff-ff-ff-ff-ff — "to everyone in the neighborhood"
Trust without verification	ARP’s structural weakness — the seed of spoofing

Today’s Commands

Command	What it does
`ipconfig /all`	Check my MAC (Physical Address)
`arp -a`	View the ARP cache (neighbor roster)
`arp -a \| findstr address`	Find only a specific address in the roster
`Get-NetNeighbor -AddressFamily IPv4`	View neighbors together with their state
`ping -n 1 address`	Start a conversation to induce ARP (your own network only)

The Instinct That Matters More Than Commands

Shout, answer, remember — those six words are all of ARP. And the remembering happens without verification. As you study security, you’ll repeatedly meet protocols that "assume a good neighborhood." Half of modern security is the work of layering verification on top of that trust.

Get to know your usual arp -a look. Building a baseline of normal doesn’t start from grand tools — it starts from the habit of peeking in once in a while. An unfamiliar MAC, a familiar MAC attached to a wrong address — strangeness is visible only to eyes that know the ordinary.

Once every box is checked, Step 32 is complete.