ARP / Ethernet Analysis

A packet-level look at how local Ethernet delivery supports higher-layer communication before an HTTP exchange can leave the local network.

Overview

This case study examines Ethernet frames and ARP traffic from a Wireshark capture. The focus is on how a host uses local MAC addressing for delivery to the gateway, while IP addressing identifies the remote endpoint.

Objective

Identify the relationship between IP destinations, Ethernet source and destination addresses, ARP broadcasts, and the gateway MAC address used for off-network traffic.

Environment / Scenario

ToolWireshark

ProtocolsEthernet II, ARP, IPv4, TCP, HTTP

Local host192.168.2.198

Remote server128.119.245.12

What I Investigated

How an HTTP request to a remote server is carried inside an Ethernet frame.
Why the Ethernet destination is the local router rather than the remote web server.
How ARP discovers the MAC address associated with a local IP address.
How broadcast addressing is used when the sender does not yet know a destination MAC address.

Key Observations

The HTTP request targets a remote IP address, but the Ethernet destination MAC belongs to the local gateway.
The Ethernet frame type identifies the payload being carried, such as IPv4 for the HTTP exchange or ARP for address resolution.
The ARP request is sent to the broadcast MAC address because the sender is asking the local network who owns a specific IP address.
The ARP response provides the missing MAC mapping so later frames can be addressed directly.

Annotated Screenshots

Wireshark Ethernet frame showing HTTP GET sent to the gateway MAC address — Wireshark capture showing an HTTP GET to a remote server while the Ethernet destination is the local gateway MAC address. This illustrates that off-network traffic is first delivered locally to the router.

Wireshark ARP request showing source MAC address — This frame illustrates the local host sending an ARP request and exposing its source hardware address as part of the request.

Wireshark ARP request showing broadcast destination MAC address — Wireshark capture showing the ARP request sent to ff:ff:ff:ff:ff:ff. Broadcast delivery is used because the sender has not yet resolved the target MAC address.

Why It Matters for Troubleshooting

When a host cannot reach other systems, ARP and Ethernet behavior help determine whether the problem is local or further upstream. If ARP fails for the default gateway, web, DNS, and other higher-layer traffic will fail even when the IP configuration appears correct.

Key Takeaways

IP identifies the end-to-end destination, while Ethernet handles local frame delivery.
Traffic leaving a subnet is addressed to the gateway MAC address at Layer 2.
ARP is a prerequisite for local IPv4 communication when the MAC mapping is unknown.