|  | 11.2 | Network-to-Network Communications
| 11.2.5 | ARP operation within a subnet

If a host wants to send data to another host, it must know the destination IP address. If it is unable to locate a MAC address for the destination in its own ARP table, the host initiates a process called an ARP request. An ARP request enables it to discover the destination MAC address.

A host builds an ARP request packet and sends it to all devices on the network. To ensure that all devices see the ARP request, the source uses a broadcast MAC address. The broadcast address in a MAC addressing scheme has all places set to hexadecimal F. Thus, a MAC broadcast address would have the form FF-FF-FF-FF-FF-FF.

Because ARP request packets travel in a broadcast mode, all devices on the local network receive the packets and pass them up to the network layer for further examination. If the IP address of a device matches the destination IP address in the ARP request, that device responds by sending the source its MAC address. This is known as the ARP reply.

Example:
Source device 197.15.22.33 is asking for the MAC address of the destination with IP address 197.15.22.126, Destination device 197.15.22.126 picks up the ARP request and responds with an ARP reply containing its MAC address.

Once the originating device receives the ARP reply, it extracts the MAC address from the MAC header, and updates its ARP table. The originating device can then properly address its data with both a destination MAC address and a destination IP address. It uses this new information to perform Layer 2 and Layer 3 encapsulations of the data before it sends them out over the network.

When the data arrives at the destination, the data link layer makes a match, strips off the MAC header, and transfers the data up to the network layer. The network layer examines the data and finds that the IP address matches the destination IP address carried in the IP header. The network layer strips off the IP header and transfers the encapsulated data to the next highest layer in the OSI model, the transport layer (Layer 4). This process is repeated until the rest of the packet's partially decapsulated data reaches the application, where the user data may be read.