To understand how ARP translates IP addresses to MAC addresses, consider the following example. Assume host A has an IP address of 192.0.2.5/24 and a MAC address of fc:99:47:49:d4:a0, and wants to send a packet to host B with an IP address of 192.0.2.7. Note that the network number is the same for both hosts, so host A is able to send frames directly to host B.
The first time host A attempts to communicate with host B, the destination MAC address is not known. Host A makes an ARP request to the local network. The request is a broadcast with a message like this:
To: everybody (ff:ff:ff:ff:ff:ff). I am looking for the computer who has IP address 192.0.2.7. Signed: MAC address fc:99:47:49:d4:a0.
Host B responds with a response like this:
To: fc:99:47:49:d4:a0. I have IP address 192.0.2.7. Signed: MAC address 54:78:1a:86:00:a5.
Host A then sends Ethernet frames to host B.
You can initiate an ARP request manually using the arping command. For example, to send an ARP request to IP address 192.0.2.132:
$ arping -I eth0 192.0.2.132
ARPING 192.0.2.132 from 192.0.2.131 eth0
Unicast reply from 192.0.2.132 [54:78:1A:86:1C:0B] 0.670ms
Unicast reply from 192.0.2.132 [54:78:1A:86:1C:0B] 0.722ms
Unicast reply from 192.0.2.132 [54:78:1A:86:1C:0B] 0.723ms
Sent 3 probes (1 broadcast(s))
Received 3 response(s)
To reduce the number of ARP requests, operating systems maintain an ARP cache that contains the mappings of IP addresses to MAC address. On a Linux machine, you can view the contents of the ARP cache by using the arp command:
$ arp -n
Address HWtype HWaddress Flags Mask Iface
192.0.2.3 ether 52:54:00:12:35:03 C eth0
192.0.2.2 ether 52:54:00:12:35:02 C eth0