A MAC address and an IP address identify different things for different forwarding decisions
A MAC address is a Layer 2 identifier used on local data-link segments such as Ethernet. An IP address is a Layer 3 logical address used for delivery across IP networks. They often appear together in the same communication, but one does not replace the other.
A switch forwards Ethernet frames using MAC addresses. A router selects an IP route using the destination IP prefix. That is the simplest functional distinction.
The IP destination can stay the same while the frame MAC addresses change at every routed hop
Suppose a client sends an IP packet to a server on another network. The packet's destination IP is the remote server. On the first Ethernet segment, however, the destination MAC is the default gateway's interface. After routing, the next Ethernet frame is built for the next local link, so its source and destination MAC addresses can change while the IP destination remains the remote server.
This explains why a client does not ARP for the MAC address of an Internet server. ARP is local; the client ARPs for its local next hop.
ARP connects a local IPv4 next-hop address to a MAC address
When a host needs to send an Ethernet frame to a local IPv4 next hop, it can use ARP to discover the corresponding MAC address. The resulting mapping appears in an ARP/neighbor cache. A changing or conflicting mapping can be evidence of duplicate IP use, while no ARP response can point toward Layer 2 reachability or VLAN problems.
Switches learn MAC locations from source addresses
An Ethernet switch examines the source MAC address of received frames and associates that address with the ingress port and VLAN. It uses the learned table to forward future known-unicast traffic efficiently. The switch does not need to read the destination IP to perform ordinary Layer 2 forwarding.
MAC addresses are local-link information; IP addresses support routed end-to-end addressing
Routers break Layer 2 broadcast domains. A MAC address that is meaningful on one Ethernet segment is not forwarded unchanged across the entire routed path. IP addressing provides the logical hierarchy routers use to move packets between networks.
Which address should you inspect for which symptom?
| Question | More relevant evidence |
|---|---|
| Is the switch learning the endpoint on the expected port/VLAN? | MAC table |
| Are two IPv4 endpoints in the same subnet? | IP addresses and prefixes |
| Which local device owns the gateway IP? | ARP mapping |
| Which route will the router choose? | Destination IP and routing table |
| Is an IP conflict moving between two Layer 2 identities? | ARP entries and MAC evidence |
Swipe horizontally to see the full table.
Three mistakes to avoid
- A MAC address is not a replacement for an IP address on routed networks.
- A public IP address does not mean the endpoint's Ethernet MAC is visible across the Internet.
- A switch can forward ordinary Ethernet frames without acting as an IP router.
Follow the addresses through a routed example
Client A is 192.168.10.25/24, gateway G is 192.168.10.1, and remote server S is 10.50.8.20. A sends an IP packet whose destination is 10.50.8.20. On A's LAN, the Ethernet destination is G's MAC address. G removes that local frame, makes a routing decision from the IP destination, and sends the packet in a new frame appropriate to the next link. The server IP remains the packet destination throughout normal forwarding.