Ethernet, ARP, and Local Delivery

Before a packet can be routed it has to survive one hop. This note is about that hop: framing, MAC addresses, ARP, and the very ordinary failures that look like routing problems.

Ethernet in one paragraph

Ethernet is a best-effort local delivery system. A frame has a destination MAC, a source MAC, an EtherType saying what is inside, 46–1,500 bytes of payload, and a CRC. Switches learn which MAC lives on which port and forward frames only where they need to go; a hub repeated everything to everyone and is now only a museum piece.

ARP: turning an IP into a MAC

ARP asks "who has 192.168.1.1?" as a broadcast and gets a unicast reply with the MAC. The answer is cached for a few minutes. IPv6 does the same job with Neighbor Discovery over ICMPv6 (solicitation/advertisement) instead of ARP.

ip neigh                     # the cache, with state (REACHABLE, STALE, FAILED)
ip neigh flush dev eth0      # reproduce a cold start
arping -I eth0 192.168.1.1   # ask directly, bypassing the cache

FAILED in the neighbour table is a precise diagnosis: the link is up, the IP is configured, and nobody answered. That is a different problem from "no route", and it points at VLAN mismatch, a wrong subnet mask, a firewall on the host, or a duplicate IP.

Switches, MAC tables, and floods

A switch builds a table of MAC → port → VLAN. Unknown unicast, broadcast and multicast are flooded within the VLAN. Once the destination replies, the table learns it and flooding stops.

Two consequences worth internalising:

1. Broadcast domains are VLANs. A large flat VLAN is a large blast radius for broadcast traffic and for ARP spoofing.
2. MAC table exhaustion is a real attack. Generate enough source MACs and a switch starts flooding everything — which is why port security exists.

Duplex, speed, and the errors that hide

Duplex mismatch is the classic: one side full, one side half, no error visible in ping, throughput collapses under load because of late collisions.

Broadcast vs unicast vs multicast

• Unicast — one to one, forwarded by MAC table.
• Broadcast — one to all in the VLAN. ARP, DHCP Discover. Never routed (except directed broadcast, which you should block).
• Multicast — one to a group. IGMP snooping decides who receives it; without snooping, multicast floods.

Where it goes wrong

• Two devices, same IP. The second one wins the ARP race intermittently, so the symptom is "sometimes it works". Check arping and duplicate-address detection, not the router.
• Wrong mask on one host. A /24 host talking to a /25 neighbour sends traffic for "remote" addresses to the gateway, and the gateway sends it back — asymmetric, confusing, and fixed only by reading the host's actual mask.
• Proxy ARP masking a routing mistake. A router answering ARP for everything makes a broken subnet look flat, until it doesn't scale.
• MAC flapping. A loop or a mis-cabled pair makes a MAC appear on two ports; the switch logs flapping and the network stutters. Usually a loop, sometimes a virtualisation bridge.
• Assuming Wi-Fi is Ethernet. 802.11 has its own framing, retries and rate adaptation; a "layer 2 problem" on Wi-Fi is often airtime, not MAC addresses.

Related Notes

• Packet Flow Encapsulation — where this step sits
• VLANs Trunking — VLANs and tagging
• STP And Loop Prevention — what happens when frames loop
• IP TCP UDP — what is inside the frame