Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about the differences between MAC and IP addresses, and why we need both of them.

To summarize, MAC addresses are physical unchangeable unique IDs for every single device while IP addresses are assigned, changeable and virtual. To analogize, MAC addresses are like people who have permanent names, and IP addresses are where they currently live.

In the real world, we link addresses and names with the help of a phonebook. What mechanism links IP addresses to MAC addresses and where is this mechanism located in the network?

share|improve this question
After reviewing your questions, I think you'd benefit from a good book. Consider studying something along the lines of TCP/IP Illustrated, Vol. 1: The Protocols by Stevens (FYI, the 1993 edition is generally considered better than the 2011 re-release, although the 1993 edition only covers IPv4 in depth). – Mike Pennington Jun 26 '14 at 10:08
"The Illustrated Network: How TCP/IP Works in a Modern Network" and / or "TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference" might also be worth a look. – Jens Link Jun 26 '14 at 10:18
@MikePennington Thank you, that is a nice way to word it, as opposed to a "RTFM" and a -1. I am reading it now online :) – Imray Jun 26 '14 at 10:21
Related:… – leonbloy Jun 26 '14 at 11:41
I think the question needs to be re-worded to "How are IP addresses associated with MAC addresses?" – Ahmet Cemil Sabır Jun 27 '14 at 12:52

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy).

To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all devices in the network), asking who has that IP address. The device with that IP address replies to the ARP (with its MAC address).

share|improve this answer
most of the time it just looks up from a local arp table I think. Just the first time it has to do a broadcast – Cruncher Jun 26 '14 at 13:46
^ yeah ofcourse, after it finds out the devices MAC, it stores in in an ARP table for some time (couple of minutes), so it doesn't have to repeat the ARP query process for each packet. – mulaz Jun 26 '14 at 14:03
Oh, I didn't realise that it dropped the table after a couple of minutes. I thought it held for a while. Does that mean to ARP poison, you need to send ARP responses quasi-frequently? – Cruncher Jun 26 '14 at 14:13
Yes, and the "real" host, must not send any packets to the poisoned machine, or the machine will store the 'real' MAC. – mulaz Jun 26 '14 at 14:17
Generally as an attacker you would poison both ends though correct? – Cruncher Jun 26 '14 at 14:23

since the question was tagged with IPv6 I'll answer on that, for IPv6 is very different to IPv4.

To begin with, there is no such thing as ARPv6, and ARP itself cannot be used, because it was made for 4-byte network layer addresses (i.e. IPv4).

This part is taken up by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away as is custom with legacy IP. The NDP provides two message types that are of interest here: Neighbor Solicitation and Neighbor Advertisement. A node that wants to learn a link-layer address (note that while ARP is for IPv4->MAC, NDP can map IPv6 addresses to link-layer addresses of any type) for a particular IP address sends a Neighbor Solicitation to the according link-local solicited-node multicast address - there is no broadcast for IPv6 any more.

For example, if the address in question is 2001:db8::0011:2233:4455:6677, then the according solicited-node multicast address is ff02::155:6677, and the according ethernet multicast address is 33:33:01:55:66:77. All nodes with an address ending on *55:6677 belong to that multicast groups and will listen to that - this is most likely only the target system itself. The Neighbor Solicitation contains also the unicast IPv6 addresses and the MAC address of the soliciting system.

On receipt, the target node answers with its Neighbor Advertisement which is sent to the unicast address (link layer and IPv6) of the soliciting node. Thus the soliciting node learns the MAC-address of the target node.

And yes, NDP-spoofing works much like ARP-spoofing. And no, IPsec is not the answer.

share|improve this answer
  1. MAC addresses can be change. On Linux use ip or ifconfig for most Windows look at the driver settings of your network interface.

  2. You don't convert anything. MAC addresses are on Layer-2, IP on Layer-3 of the OSI model. For IPv4 ARP is used to find out which MAC (Layer-2) address belongs to a certain IP (Layer-3) address. For IPv6 ICMPv6 (Neighbor Discovery) is used.

share|improve this answer
Sorry, I should have said "translate" not "convert" – Imray Jun 26 '14 at 10:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.