Most local traffic never reaches a router. It is delivered by Ethernet frames and MAC addresses inside a broadcast domain.
Frames and MAC addresses
An Ethernet frame has a destination MAC, source MAC, EtherType, payload and trailer. A MAC address is 48 bits, usually written as six hex pairs.
A switch learns which MAC addresses are reachable on which ports. When it receives a frame:
- known destination: forward out the correct port;
- unknown destination: flood out all ports in the VLAN;
- broadcast: flood;
- same port as source: drop.
ARP
IPv4 hosts need a MAC address for the next hop. ARP asks "who has this IP?" and the owner replies with its MAC. The result is cached.
ARP request: who has 192.168.1.1? tell 192.168.1.42
ARP reply: 192.168.1.1 is at aa:bb:cc:dd:ee:ff
ARP spoofing sends false replies to associate an attacker's MAC with another IP, redirecting local traffic. Dynamic ARP inspection and segmentation reduce the risk.
arp -a # macOS/Linux
arp -a # Windows also works
ip neigh # Linux
Key takeaways
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.