# Ethernet, ARP, and Local Delivery

Before a packet can be routed it has to survive one hop. This note is about that hop: framing, MAC addresses, ARP, and the very ordinary failures that look like routing problems.

## Ethernet in one paragraph

Ethernet is a best-effort local delivery system. A frame has a destination MAC, a source MAC, an EtherType saying what is inside, 46–1,500 bytes of payload, and a CRC. Switches learn which MAC lives on which port and forward frames only where they need to go; a hub repeated everything to everyone and is now only a museum piece.

| Field | Size | Notes |
|---|---|---|
| Destination MAC | 6 bytes | `ff:ff:ff:ff:ff:ff` is broadcast |
| Source MAC | 6 bytes | Assigned per interface |
| 802.1Q tag | 4 bytes | Present only on tagged (trunk) frames |
| EtherType | 2 bytes | `0x0800` IPv4, `0x86DD` IPv6, `0x0806` ARP |
| Payload | 46–1,500 | Padded if short; MTU if long |
| FCS | 4 bytes | Discarded frames are counted, not retried |

## ARP: turning an IP into a MAC

ARP asks "who has 192.168.1.1?" as a broadcast and gets a unicast reply with the MAC. The answer is cached for a few minutes. IPv6 does the same job with Neighbor Discovery over ICMPv6 (solicitation/advertisement) instead of ARP.

```bash
ip neigh                     # the cache, with state (REACHABLE, STALE, FAILED)
ip neigh flush dev eth0      # reproduce a cold start
arping -I eth0 192.168.1.1   # ask directly, bypassing the cache
```

`FAILED` in the neighbour table is a precise diagnosis: the link is up, the IP is configured, and nobody answered. That is a different problem from "no route", and it points at VLAN mismatch, a wrong subnet mask, a firewall on the host, or a duplicate IP.

## Switches, MAC tables, and floods

A switch builds a table of `MAC → port → VLAN`. Unknown unicast, broadcast and multicast are flooded within the VLAN. Once the destination replies, the table learns it and flooding stops.

Two consequences worth internalising:

1. **Broadcast domains are VLANs.** A large flat VLAN is a large blast radius for broadcast traffic and for ARP spoofing.
2. **MAC table exhaustion is a real attack.** Generate enough source MACs and a switch starts flooding everything — which is why port security exists.

## Duplex, speed, and the errors that hide

| Symptom | Likely cause | Where to look |
|---|---|---|
| CRC errors, slow throughput, no loss on small pings | Bad cable or duplex mismatch | `ethtool -S`, `show interfaces counters errors` |
| Link flaps every few minutes | PoE budget, cable, or optics | Interface log, `dmesg`, transceiver diagnostics |
| Works at 100 Mbps, fails at 1 Gbps | Cable category or pair damage | Cable test, replace patch lead |
| Frames arriving with wrong VLAN | Trunk/native VLAN mismatch | Switch config, `tcpdump -e` to see tags |

Duplex mismatch is the classic: one side full, one side half, no error visible in `ping`, throughput collapses under load because of late collisions.

## Broadcast vs unicast vs multicast

- **Unicast** — one to one, forwarded by MAC table.
- **Broadcast** — one to all in the VLAN. ARP, DHCP Discover. Never routed (except directed broadcast, which you should block).
- **Multicast** — one to a group. IGMP snooping decides who receives it; without snooping, multicast floods.

## Where it goes wrong

- **Two devices, same IP.** The second one wins the ARP race intermittently, so the symptom is "sometimes it works". Check `arping` and duplicate-address detection, not the router.
- **Wrong mask on one host.** A `/24` host talking to a `/25` neighbour sends traffic for "remote" addresses to the gateway, and the gateway sends it back — asymmetric, confusing, and fixed only by reading the host's actual mask.
- **Proxy ARP masking a routing mistake.** A router answering ARP for everything makes a broken subnet look flat, until it doesn't scale.
- **MAC flapping.** A loop or a mis-cabled pair makes a MAC appear on two ports; the switch logs flapping and the network stutters. Usually a loop, sometimes a virtualisation bridge.
- **Assuming Wi-Fi is Ethernet.** 802.11 has its own framing, retries and rate adaptation; a "layer 2 problem" on Wi-Fi is often airtime, not MAC addresses.

## Teaching hook

**The street analogy.** The IP address is the postal address; the MAC is the name on the doorbell. The courier only needs the doorbell for the final step, and every new street has its own doorbells.

Lab that makes it click: two Linux namespaces on one bridge, `ping` between them, then `ip neigh flush` and watch ARP in `tcpdump -e`. Add a duplicate IP and watch the intermittent failure appear.

## Related Notes

- [[Foundations/Packet-Flow-Encapsulation.md]] — where this step sits
- [[Switching-LAN/VLANs-Trunking.md]] — VLANs and tagging
- [[Switching-LAN/STP-And-Loop-Prevention.md]] — what happens when frames loop
- [[Core-Protocols/IP-TCP-UDP.md]] — what is inside the frame