DEV Community

Tejas Shinkar
Tejas Shinkar

Posted on Edited on

How Hosts Actually Communicate on a Network- ARP and Default Gateway

#devops #cloud #networking #aws

🌐 ARP and Default Gateway

Everything Hosts Do to Speak on the Internet — Part 1 & Part 2

Series: Networking Fundamentals for Cloud & DevOps — Part 3 of 6

We already know that IP addresses are used at Layer 3 and MAC addresses are used at Layer 2. But there is an important practical question: what does a host do when it knows the destination IP but doesn't know the destination MAC?

The answer is ARP.

Part 1 — When the Destination Is on the Same Network

Suppose we have two hosts:

  • Host A — MAC a2a2, IP 10.1.1.22, mask 255.255.255.0
  • Host B — MAC b3b3, IP 10.1.1.33, mask 255.255.255.0

With a /24 mask (255.255.255.0), the network is 10.1.1.0/24. Both hosts belong to the same network, so they can communicate directly at Layer 2.

1. A Wants to Send Data to B

Suppose A wants to send data to B. A already knows B's IP address (10.1.1.33) — maybe learned from DNS, or the application already knows it.

So A can create the Layer 3 IP header: SRC IP = 10.1.1.22, DST IP = 10.1.1.33.

But there is a problem: A doesn't know B's MAC, and Ethernet / Layer 2 needs a destination MAC address.

IP address is known, but MAC address is unknown → use ARP.

2. ARP = Address Resolution Protocol

ARP = Address Resolution Protocol. ARP basically asks:

"Who has IP 10.1.1.33? Tell me your MAC address."

A sends an ARP Request. Conceptually:

Host A — My IP = 10.1.1.22, My MAC = a2a2 — "Who has 10.1.1.33? Please tell me your MAC."

The important point is that A knows the destination's IP, but needs to discover the corresponding MAC.

3. Why Is the ARP Request Broadcast?

A doesn't know B's MAC yet, so A cannot send the ARP request directly to B's unicast MAC address. Instead, it uses the special Ethernet broadcast MAC ff:ff:ff:ff:ff:ff — meaning "send this to everyone on the local network."

                 ARP Request
A ───────────────────────→ Everyone
                              │
                              ├── B
                              ├── C
                              ├── D
                              └── ...
Enter fullscreen mode Exit fullscreen mode

Every device on the local network receives the ARP request. But only the device whose IP address matches 10.1.1.33 cares about it.

4. Host B Responds

B sees "Who has 10.1.1.33?" and knows its own IP (10.1.1.33) and MAC (b3b3). So B sends an ARP Reply directly back to A: 10.1.1.33 → b3b3.

"I am 10.1.1.33, and my MAC address is b3b3."

This response is unicast, because B now knows A's MAC address.

5. ARP Cache

A stores the discovered mapping in its ARP cache: 10.1.1.33 → b3b3. Similarly, B can learn 10.1.1.22 → a2a2.

Now, if A wants to communicate with B again, it doesn't need to immediately broadcast another ARP request — it can simply check its ARP cache (10.1.1.33 → b3b3) and construct the Ethernet frame.

ARP gives the host the Layer 2 address it needs after knowing the Layer 3 destination.

6. A Can Finally Send the Actual Data

A now knows both Destination IP = 10.1.1.33 and Destination MAC = b3b3. So it creates a Layer 3 header (SRC IP = 10.1.1.22, DST IP = 10.1.1.33) and a Layer 2 header (SRC MAC = a2a2, DST MAC = b3b3).

The resulting structure is:

┌──────────────────────────────┐
│ L2 Header                    │
│ SRC MAC: a2a2                │
│ DST MAC: b3b3                │
├──────────────────────────────┤
│ L3 Header                    │
│ SRC IP: 10.1.1.22            │
│ DST IP: 10.1.1.33            │
├──────────────────────────────┤
│ Data                         │
└──────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

And it is sent: A ─────────────────────────→ B

7. What Happens When B Receives It?

B receives the Ethernet frame and first checks the destination MAC (DST MAC = b3b3). That's B's own MAC, so B accepts the frame.

The Layer 2 header is processed and removed (L2 ✓). B then checks the Layer 3 destination (Destination IP = 10.1.1.33) — that's B's own IP address, so the IP header is processed and removed too (L3 ✓).

The remaining data moves upward to the appropriate protocol/application:

L2 → remove · L3 → process/remove · L4 → process · L7 → application

The Most Important Distinction

This is one of the most important things to remember:

IP Address answers: "Which host ultimately should receive this data?"
MAC Address answers: "Which device should receive this frame on this local network/hop?"

L3 → IP → end-to-end destination. L2 → MAC → current hop.

ARP connects these two worlds by resolving IP address → MAC address.

Part 2 — What Happens When the Destination Is on Another Network?

Now consider a more realistic situation. Host A wants to communicate with Host C, but C is on a different network.

Host A                         Router                         Host C
10.1.1.22                      10.1.1.1                       10.9.9.44
MAC a2a2                       MAC e5e5                       MAC c4c4
     │                              │                              │
     └────── Local network ─────────┘────── Other networks ───────┘
Enter fullscreen mode Exit fullscreen mode

A wants to send data to Destination IP = 10.9.9.44. A checks its subnet (10.1.1.0/24) and realizes 10.9.9.44 is not in its network — so A needs the default gateway / router.

This is the key difference from Part 1:

A does NOT ARP for C. A ARPs for its default gateway.

1. A Knows C's IP

The Layer 3 destination remains C: SRC IP = 10.1.1.22, DST IP = 10.9.9.44. Notice that the destination IP is still the final destination — A does not replace C's IP with the router's IP.

2. A ARPs for the Gateway

A asks:

"Who has 10.1.1.1? Tell me your MAC."

The router replies 10.1.1.1 → e5e5, and A stores this in its ARP cache (10.1.1.1 → e5e5). Now A knows the MAC address of the device that should receive the frame.

3. A Creates the Frame

Now notice the important part:

L3:  SRC IP  = 10.1.1.22      DST IP  = 10.9.9.44
L2:  SRC MAC = a2a2           DST MAC = e5e5
Enter fullscreen mode Exit fullscreen mode 
IP says:
"Ultimately go to C"
             ↓
A ─────────────────────→ Router


MAC says:
"This particular frame goes to the router"
Enter fullscreen mode Exit fullscreen mode

This is one of the most important concepts in these networking fundamentals. The IP packet is intended for the final destination, but the Ethernet frame is intended for the next hop.

4. Router Receives the Frame

The router receives the Ethernet frame and sees DST MAC = e5e5 — that's its own MAC address, so it accepts the frame and removes/processes the Layer 2 header.

Now it looks at the Layer 3 destination (DST IP = 10.9.9.44) and checks its routing table to determine where the packet should go next. This connects directly to what we learned earlier:

Routers make forwarding decisions using Layer 3 destination IP addresses and routing tables.

5. Router Forwards It Hop-by-Hop

There may be multiple routers between A and C:

A
│
▼
Router 1
│
▼
Router 2
│
▼
Router 3
│
▼
C
Enter fullscreen mode Exit fullscreen mode

At every hop, the Layer 2 / MAC addresses change. But the Layer 3 destination remains 10.9.9.44:

Hop 1 → MAC: A → Router 1          IP: A → C
Hop 2 → MAC: Router 1 → Router 2   IP: A → C
Hop 3 → MAC: Router 2 → Router 3   IP: A → C
Enter fullscreen mode Exit fullscreen mode

So the mental model is:

MAC = current hop. IP = final destination.

This is exactly why we previously described:

L2 → hop-to-hop. L3 → end-to-end.

ARP in One Picture

The complete idea can now be summarized as:

Same network:

A ── ARP for B's MAC ──→ B
        │
        └── IP known
            MAC unknown


Different network:

A ── ARP for gateway's MAC ──→ Router
                                 │
                                 ▼
                              Other network
                                 │
                                 ▼
                                  C
Enter fullscreen mode Exit fullscreen mode

The crucial difference:

Same network → ARP for destination host. Different network → ARP for default gateway.

The Complete Mental Model

When a host wants to send an IP packet:

1. Know the destination IP
          ↓
2. Check: Is destination in my local network?
          ↓
      ┌───┴────┐
     YES       NO
      │         │
      ↓         ↓
ARP for       ARP for
destination   default gateway
MAC           MAC
      │         │
      └────┬────┘
           ↓
   Build Ethernet frame
           ↓
      Send to next hop
Enter fullscreen mode Exit fullscreen mode

And remember the hierarchy:

  • L4 → Port — which service?
  • L3 → IP — which host/network ultimately?
  • L2 → MAC — which device on this hop?
  • L1 → Bits — physical transmission

For your Cloud + DevOps learning, this becomes extremely important when reasoning about:

  • VPC routing
  • Subnets
  • Default routes
  • VPC routers
  • Security Groups
  • NACLs
  • Load Balancers
  • Connectivity troubleshooting

The AWS abstraction changes, but the underlying question remains the same:

Where is the destination, and what is the next hop needed to reach it?

Part 3 of 6 — Networking Fundamentals for Cloud & DevOps
A prerequisite for understanding AWS VPC routing, subnets, gateways, and connectivity troubleshooting.

Top comments (0)