The Local Neighborhood

IP routing gets all the attention, but a packet can only travel across the internet because it first travels one hop across your local network. That local hop is Ethernet (or Wi-Fi), and it works entirely by MAC addresses, not IP addresses.

MAC Addresses

A Media Access Control (MAC) address is a 48-bit hardware identifier burned into every network interface, written as six hex octets (e.g., 3c:22:fb:1a:2b:9c). The first three octets are the OUI (Organizationally Unique Identifier) assigned to the manufacturer; the last three are the device serial. MAC addresses are only meaningful within a single Layer 2 broadcast domain.

ARP: Bridging IP and MAC

Your computer knows the destination IP (say 142.250.72.14 for Google), but Ethernet frames need a destination MAC. The Address Resolution Protocol (ARP) bridges the two:

  1. Your host broadcasts an ARP request: "Who has 192.168.1.1? Tell me your MAC."
  2. The device with that IP replies directly with its MAC.
  3. Your host caches the mapping and builds the Ethernet frame.

Run arp -a on any OS to see your local ARP cache. ARP has no authentication, which is why ARP spoofing (an attacker answering on behalf of the gateway) is the foundation of many man-in-the-middle attacks on local networks.

Switches vs. Hubs

A hub repeats every incoming frame out every port, forcing every device to share one collision domain. A switch learns which MAC addresses live on which physical port and forwards frames only out the correct port. This is why modern LANs can run many devices in parallel without chaotic collisions. The switch's forwarding table is built by watching the source MAC of every frame it receives—no configuration required.

VLANs

A single physical switch can host many logical networks using VLANs (Virtual LANs). Each port is assigned a VLAN tag (IEEE 802.1Q), and frames on different VLANs are isolated from each other even though they share hardware. Enterprises use VLANs to separate guest Wi-Fi from corporate machines from IoT devices, effectively creating many isolated Layer 2 domains on one physical plant.

Broadcast Domains and Loops

Because ARP and other protocols rely on broadcasts, an Ethernet network is a broadcast domain. Connecting switches in a physical loop creates a broadcast storm—frames circulate forever and saturate the network. The Spanning Tree Protocol (STP) solves this by logically disabling redundant links, keeping exactly one active path while leaving backups ready to activate if the primary fails.

Why This Matters Above Layer 2

When you debug a "network problem," it is often a Layer 2 problem. A flapping cable, a duplicate MAC, an ARP storm, or a misconfigured VLAN will present as an intermittent outage that looks like an application failure. For anyone writing distributed systems, knowing that the local hop is switch-and-MAC territory explains why datacenter topologies (spine-leaf, EVPN, VXLAN) exist and why the cloud abstracts all of it away behind a virtual network interface.

How a Frame Travels One Hop

It helps to trace a single frame across the local network. The host has an IP packet ready to send. It compares the destination IP with its own subnet mask: if the destination is local, it ARPs for the destination directly; if the destination is remote, it ARPs for the default gateway instead. Either way, it obtains a MAC, wraps the IP packet in an Ethernet frame with that MAC as destination and its own MAC as source, and transmits. The switch reads the destination MAC, consults its forwarding table, and emits the frame on exactly one port. At the far end, the NIC accepts frames addressed to its MAC (or to a broadcast/multicast address), strips the Ethernet header, and hands the IP packet up the stack. Every hop across the internet repeats this dance, which is why ARP and switching are not trivia—they are the mechanism that makes routing possible.