A Beginner-Friendly Look into ARP, MAC, and IP Communication
Have you ever tried connecting two PCs and checked how packet flows between two directly connected Computers/PC’s — especially when they don’t even know each other’s MAC address?
Today, let’s explore that magic moment when PC1 pings PC2 and what happens under the hood — packet by packet — using real Wireshark capture insights.
My Lab Setup
Here’s how I set up my mini lab:
PC1 – IP: 12.1.1.1/24
PC2 – IP: 12.1.1.2/24
Both PCs are directly connected via a simple Ethernet cable. No switches, no routers — just pure, one-to-one communication.
Diagram –
I have configured the IP address 12.1.1.1/24 on PC1
Similarly I have configured the IP Address 12.1.1.2/24 on PC2.
The First Observation: Empty ARP Table
Before sending any packets, I checked the ARP tables on both PCs.
Guess what? They were empty.
So, if PC1 doesn’t even know PC2’s MAC address… how can it send a ping? Let’s walk through it:
I have checked the ARP table at PC1 and at PC2 but it is showing blank, please check below snap –
Step 1: PC1 Sends an ARP Request – “Who Has 12.1.1.2?”
Let’s imagine this: I go to PC1 and try to ping PC2’s IP address (12.1.1.2). Sounds simple, right?
But here’s the twist…
When I check the MAC table on PC1 before the ping — it’s completely empty. So how is the ping even possible?
This is where ARP (Address Resolution Protocol) steps in like a silent hero. Since PC1 doesn’t yet know PC2’s MAC address, it can’t build a proper Ethernet frame. So what does it do?
PC1 creates an ARP Request packet. This packet is broadcasted across the network to the special MAC address FF:FF:FF:FF:FF:FF — which means “everyone, please listen!”
And in this request, PC1 is essentially asking:
“Hey! Who owns the IP address 12.1.1.2? Please tell me your MAC address.”
Only PC2, which actually holds that IP, will respond.
In the Wireshark capture below, you’ll clearly see this ARP packet leaving PC1 and searching for its match. That’s how communication begins — even before the first ICMP Echo Request goes out.
Step 2: PC2 Replies with Its MAC Address
Now that PC1 has broadcasted the ARP request asking, “Who has 12.1.1.2?”, PC2 receives it and knows it’s the intended recipient.
So, what does PC2 do?
It sends a unicast ARP reply directly back to PC1 — this time, not to the whole network, but just to the sender.
In this response, PC2 basically says:
“I’m 12.1.1.2, and here’s my MAC address.”
Once PC1 receives this reply, it immediately updates its ARP table, linking the IP address 12.1.1.2 with PC2’s MAC address.
You can refer to the screenshot below to see this ARP reply packet in action — where PC2 shares its MAC address with PC1.
Now, PC1’s ARP table is no longer empty — it has successfully learned PC2’s MAC address. And the same goes for PC2 — it now knows PC1’s MAC address as well.
At this point, both devices are ready for direct communication.
Step 3: ICMP Ping (Echo Request)
With the MAC address successfully resolved, PC1 is now ready to send the actual ICMP Echo Request — the classic “ping” packet.
This time, there’s no need for broadcasting or asking questions. PC1 builds a complete Ethernet frame, including both its own MAC address (as the source) and PC2’s MAC address (as the destination).
At this point, ARP has done its job — its role was just to help find the MAC address. Now, the ICMP protocol takes over and sends the packet with all the required details to reach PC2 directly.
Step 4: PC2 Sends an ICMP Echo Reply
Once PC2 receives the ICMP Echo Request from PC1, it knows exactly what to do — it sends back an ICMP Echo Reply.
This reply packet is essentially PC2 saying:
“Hey, I got your message — and I’m alive!”
In this response, the source and destination IP and MAC addresses are flipped — now PC2 becomes the source, and PC1 is the destination.
Check out the highlighted section in the screenshot below — you’ll clearly see PC2’s reply packet making its way back to PC1.
Step 5: Reverse Ping — From PC2 to PC1
To complete the two-way conversation, PC2 now initiates its own ping to PC1.
And just like before, the same process repeats — ARP resolution (if needed), ICMP request, and ICMP reply.
Since both devices now know each other’s MAC addresses, everything flows smoothly.
Successful two-way communication is now fully established!
Please check below snap –
Real-Life Relevance
You may think this is a simple setup — just two PCs and a cable. But this exact process scales up to large networks, routers, switches, cloud infrastructure, and beyond.
When basic pings fail, network engineers always check:
- Is ARP resolving?
- Is the correct MAC address in use?
- Is anything blocking the ping response?
These small things make up the big picture of troubleshooting.