I am trying to understand the ARP protocol and I could not understand the above. Consider the topology as follows:

H1( - ( - H2(

My understanding is that if the MAC table of host1 does not have an entry for destination MAC of host2, it would send an ARP query with the destination IP(, which would not be found on the subnet and the packet would be discarded. But how is the packet sent to the gateway(router or instead?

  • MAC addresses are used only within the transfer - and exist along the path a packet would use only ever between the 2 acting "hops" - first the higher level IP protocol is used to determine the path - then the actual physical transfer happens using the path .. guiding the packet along using the mac-address of the next destination on that path
    – eagle275
    Commented Feb 12, 2020 at 7:52
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Jan 5, 2021 at 19:56

5 Answers 5


The sending device uses the subnet mask to determine if the remote host is in it's local network or not.

If the IP is within the subnet of the local machine, it uses ARP to determine the MAC address of the remote host.

If it's outside, it queries it's local routing table to find the next hop of that IP, and sends out an ARP query to find the MAC address for that next hop. On most machines, the routing table just has a default route which is the upstream router, but you can define multiple routes manually. However, there can only be one default route, so if you machine has multiple interfaces, you shouldn't define a default gateway on more than one. (since the default gateway setting essentially adds a route for (aka. every single host) with the gateway set to that IP).

  • 1
    Are you claiming that the routing table is not queried if the destination IP falls "within the subnet of the local machine"? I'm sceptical, do you have a source? Also, how is "the subnet of the local machine" determined?
    – marcelm
    Commented Feb 11, 2020 at 19:34
  • @marcelm : I supect you are right, otherwise why would the local subnets appear in the routing table ?
    – grahamj42
    Commented Feb 11, 2020 at 21:05
  • @marcelm That sounds like an implementation detail, whether the host puts locally connected networks in its routing table, or whether it checks for them separately. Commented Feb 12, 2020 at 15:17
  • @marcelm Not really, it just wasn't necessary for the explanation, and frankly, I didn't really think about it. I would wager that it might be an implementation detail, as just using the netmask to check whether to even bother querying the routing table might be quite a bit faster in some situations.
    – Stuggi
    Commented Feb 13, 2020 at 5:46

To complement the other answers:

  • The first thing a host (or router, which is just a host with multiple interfaces and packet forwarding between interfaces enabled) does is check its routing table.

    The most basic routing table will usually have:

    • one entry for the local network, pointing to the relevant interface

    • one default route, pointing to the default gateway

# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface         UG        0 0          0 eth0     U         0 0          0 eth0

There could be more routes depending on the interfaces and the implementation, but this is the most basic form.

Routes are always looked up as "more specific" first. "More specific" means the route covers a smaller number of destination addresses (the prefix length is longer, or if you still talk in terms of subnet masks, the number of 1s in the subnet mask is higher).

This means a route for a single host (a /32, netmask is more specific that a route for a /24 (netmask which is more specific than the default route which is a /0 (netmask If all 3 routes "match", then the first one will be used, and so on.

  • For a packet that is destined to an IP on the local network, the host will find the route that tells it that this network is connected to that interface. It will find out that it's an Ethernet interface which uses ARP, and will lookup its ARP table (which is sometimes merged with the routing table, depending on the implementation). If it doesn't find the relevant ARP entry, it will then issue an ARP request.

  • For a packet that is destined to an IP not on the local network, it will fall back to the default route, which gives it the IP of the default gateway. Then the exercise starts again using that IP, which is now on the local network (if it wasn't, then the packet would be dropped).


There are 3 pieces of information that your computer needs in order to do this. In a typical setup, they're all provided by DHCP. If you assign a static IP address, you have to provide them all to make this work.

We're going to start off providing the both pieces of data that are missing. We'll set the subnet mask of both networks to We'll set the default gateway of network1 to and the default gateway of network2 to

Next... in your scenario host1 would never bother trying to send out an ARP query for host because it can figure out that the IP address for isn't on it's network from the combination of IP addresses and subnet mask. Each IP is combined (using an bitwise AND operation) with the subnet mask to provide the network address the computer is on. AND = AND = does not equal, and thus these IP addresses originate on different networks. Because they're on different networks, the computer doesn't need to ARP. The default gateway is named such (I assume at least) because it's the default location to send any traffic that is on a different network.


It may help to distinguish what is happening at the IP level (and would behave differently if you were using a different protocol at the routed layer), what is happening at the Ethernet level (and would behave differently if you were using a different protocol at the link layer), and what is happening in the middle (the packet encapsulation, as well as the ARP resolution which is at least conceptually not specific to IP or Ethernet). I'll describe these as happening in three different software drivers, although in practice two or three of these drivers may well be combined.

First the IP driver consults the IP routing table to determine who must receive the packet for the given target IP address. A query to the IP routing table may return one of three possible results:

  • Another IP address, which is the gateway for that target. If the IP driver gets this result, it recursively queries the routing table for the IP address of the gateway, and this repeats until the IP driver hits another case or decides that there's too much recursion (in which case the packet can't be delivered because there's no route to the target host).
  • A network interface. In this case, the IP driver will send the packet on that interface.
  • No entry (this can happen if there's no default route). In this case the packet can't be delivered because there's no route to the target host).

If a route is found, the IP driver remembers not only the final result which is the network interface, but also the IP address to send the packet to at the link layer (which is the last gateway found in the recursive lookup, or the original target IP address if no gateway was found).

In your example, the route to goes via the gateway, which is on a certain Ethernet interface of the host, let's call it eth0. So the IP driver hands down the packet to the IP-over-Ethernet driver, telling it to transmit it to on eth0.

The IP-over-Ethernet driver maintains a cache that associates IP addresses to MAC addresses. If it doesn't find the requested IP address in its cache, it sends an ARP request and waits for the answer. If it doesn't get an answer, it rejects the packet as undeliverable. Note that the IP-over-Ethernet driver only cares about the gateway address, not about the packet's final destination.

So the sending host will make an ARP request for It would never try an ARP request to since it knows it doesn't have a direct route to it.

When the IP-over-Ethernet driver has found the MAC address of, it hands down the packet to the Ethernet driver, telling it to send to that particular MAC address. The Ethernet driver sends an Ethernet frame. It doesn't care about IP addresses.


The easiest way to understand what's happening is to look at each layer one at a time.


When Host1 sends a packet to Host2 it consults its local routing table. The possible outcomes are:

  1. Host2 is located within Host1's local subnet = the gateway to Host2 is a local interface: the packet is sent directly to Host2 using the interface indicated by the routing table
  2. The routing table indicates that a gateway needs to be used: the packet is sent to the gateway.


IP uses the data link layer to send packets within a local network. It requires a way to accomplish send a packet to X, to address the target node. For MAC-based networks, the MAC address is required for addressing, and IPv4 uses ARP to find out that MAC address.

So, for direct addressing the destination IP is ARPed, and for a gateway that IP is ARPed. The resolved MAC address is used to direct the frame to X.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.