FUNDAMENTALS · MECHANISM WALKTHROUGH

Same VLAN, Same Switch
What Really Happens on the First Ping

no gateway, no routing, no firewall — the entire exchange happens at Layer 2. this is the sheet that separates "I know ARP is a thing" from "I know exactly when and why ARP fires."

LOCAL SUBNET CHECK→ ARP CACHE MISS→ ARP REQUEST (BROADCAST)→ SWITCH FLOODS→ ARP REPLY (UNICAST)→ MAC LEARNED→ ICMP ECHO→ SWITCHED UNICAST

01 The Full Sequence — Worked Example

The Command

PC-A (192.168.10.10/24, MAC AAAA.AAAA.AAAA, on switchport Fa0/1) runs ping 192.168.10.20 to reach PC-B (192.168.10.20/24, MAC BBBB.BBBB.BBBB, on Fa0/2). Both ports are access ports in VLAN 10 on the same switch.

Start

Local Subnet Check

PC-A's IP stack ANDs the destination (192.168.10.20) against its own subnet mask (/24). It lands inside 192.168.10.0/24 — same subnet as PC-A itself. Because of that, the gateway is never consulted: PC-A needs to resolve the destination's own MAC, not the gateway's. This single check is the entire reason this walkthrough looks nothing like the "PC to Internet" one.

L3 Logic

ARP Cache Check — Miss

PC-A checks its local ARP cache for an entry for 192.168.10.20. First contact ever, so it's empty. An ARP request has to go out.

ARP

ARP Request — Broadcast

PC-A sends an Ethernet frame with destination MAC FFFF.FFFF.FFFF (broadcast), source MAC AAAA.AAAA.AAAA, payload "who has 192.168.10.20? tell 192.168.10.10." It goes out Fa0/1 onto the wire.

Broadcast

Switch: Learn, Then Flood

Two separate things happen inside the switch, in this order. First, source-address learning: it reads the source MAC (AAAA.AAAA.AAAA) off the frame and records "AAAA.AAAA.AAAA lives on Fa0/1" in its MAC/CAM table — this happens for every frame, not just ARP. Second, because the destination is a broadcast, the switch floods the frame out every other port in VLAN 10 — it has no choice, a broadcast has no single destination to look up.

L2 Switch

Every Host in the VLAN Receives It

Every device on VLAN 10 — including PC-B and any other host — gets a copy of the broadcast. Each one checks the ARP payload against its own IP. Everyone except PC-B discards it. PC-B recognizes 192.168.10.20 as its own address and prepares a reply.

Filter

ARP Reply — Unicast

PC-B already learned PC-A's MAC from the request itself (it was right there in the source field), so it doesn't need to broadcast back. It sends a unicast ARP reply straight to AAAA.AAAA.AAAA: "192.168.10.20 is at BBBB.BBBB.BBBB."

Unicast

Checkpoint — What Both Sides Now Know

Switch MAC table: AAAA.AAAA.AAAA → Fa0/1, BBBB.BBBB.BBBB → Fa0/2 (learned from the reply's source field on its way in). PC-A's ARP cache: 192.168.10.20 → BBBB.BBBB.BBBB. No IP packet carrying real data has moved yet — this was purely address resolution.

Checkpoint

Switch Forwards the Reply — Known Unicast

Because the switch already had AAAA.AAAA.AAAA in its table from step 5, PC-B's reply is sent out Fa0/1 only — no flooding this time. This is the difference between an unknown unicast (destination not yet in the table → flooded) and a known unicast (destination in the table → forwarded to one port).

L2 Forward

ICMP Echo Request

PC-A now builds the actual ping: an ICMP Echo Request inside an IP packet inside an Ethernet frame addressed directly to BBBB.BBBB.BBBB — pulled straight from the ARP cache, no lookup delay this time.

ICMP

Switch Delivers — Single Table Lookup

The switch reads the destination MAC, finds BBBB.BBBB.BBBB → Fa0/2 in its table, and forwards out that one port. PC-B's NIC receives it, processes the ICMP request, and generates an Echo Reply addressed back to AAAA.AAAA.AAAA.

L2 Forward

Reply Returns the Same Way

Switch looks up AAAA.AAAA.AAAA → Fa0/1, forwards the Echo Reply straight there. ping on PC-A prints the round-trip time. No gateway, no routing table, no NAT, no firewall policy was ever involved — the entire exchange stayed inside one broadcast domain.

Delivered

02 How to Explain This in an Interview

Open with the subnet check. Say "the PC first works out the destination is on its own subnet" before anything else — that one sentence tells the interviewer you understand why the gateway is skipped, not just that it is.
Name the ARP resolves-the-destination-not-the-gateway distinction explicitly. It's the most common point of confusion versus the PC-to-Internet walkthrough, and interviewers listen for whether you conflate the two.
Use "flood" and "forward" precisely. Flooding is for broadcasts and unknown unicasts; forwarding is a table hit. Mixing these up in an answer is an instant tell.
Mention MAC learning happens on every frame, unprompted. It's easy to only associate learning with the ARP request — call out that the reply teaches the switch PC-B's location too.
Keep it to two phases: "resolve, then send" — ARP resolution first, then the actual ICMP exchange. Structuring your answer this way keeps a twelve-step mechanism sounding like two clean movements instead of a flat list.

03 Follow-Up / Gotcha Questions

Q Why does the switch flood the ARP request instead of forwarding it straight to PC-B?

A A switch forwards based on its MAC table — a destination-address lookup. A broadcast frame's destination (FFFF.FFFF.FFFF) isn't a real host to look up, so there's nothing to match; flooding to every port except the source is the only correct behavior. The switch has no idea yet which port PC-B is on.

Q Would this still work if PC-A and PC-B were in different VLANs on the same switch?

A No — the ARP broadcast would never even reach PC-B, because flooding only happens within the same VLAN's broadcast domain. Cross-VLAN traffic needs a Layer 3 hop (router-on-a-stick or an SVI) to move between them; that's a materially different mechanism, covered separately.

Q Why might the very first ping show one dropped or delayed packet?

A Many stacks send the ICMP Echo Request in parallel with — or immediately after — triggering ARP resolution, but hold it until the ARP reply arrives. If that resolution takes just long enough, the first probe can time out or show an inflated RTT while later ones (using the now-cached MAC) return quickly.

Q What happens to the switch's MAC table if PC-B is unplugged and moved to a different port?

A The old Fa0/2 entry stays until it ages out (typically 300 seconds of inactivity) or a new frame arrives from BBBB.BBBB.BBBB on the new port, which immediately overwrites the mapping. Until then, traffic to PC-B is briefly flooded again if the stale entry expires before relearning.

Q Does ARP ride on top of IP, TCP, or UDP?

A None of them — ARP is its own EtherType (0x0806) directly inside the Ethernet frame. It's a Layer 2/Layer 3 boundary protocol with no transport-layer wrapper at all, which is exactly why it can run before the host has any usable IP-layer session.

Q If the switch already learned both MACs from earlier, unrelated traffic, does ARP still happen?

A The switch's MAC table and the PC's ARP cache are completely separate things. Even if the switch already knows both ports, PC-A's own ARP cache is what's checked before sending — if that entry has expired or was never set, ARP fires regardless of what the switch already knows.

04 Quick-Fire Glossary

Term	Meaning
Known Unicast	A destination MAC the switch already has in its table — forwarded to one port only
Unknown Unicast	A unicast destination the switch hasn't learned yet — flooded to all ports in the VLAN as a fallback
Flooding	Sending a frame out every port in the broadcast domain except the one it arrived on
Broadcast Domain	The set of ports (i.e. one VLAN) that all receive a given broadcast frame
MAC / CAM Table Aging	Learned entries expire after a period of inactivity (default 300s on most Cisco platforms)
ARP Cache Timeout	How long a host keeps a resolved IP→MAC mapping before re-resolving (commonly ~4 hours on Windows)
EtherType 0x0806	The Ethernet frame type field value that identifies the payload as ARP
ICMP	Internet Control Message Protocol — carries ping's Echo Request/Reply
Gratuitous ARP	An unsolicited ARP a host sends about itself, e.g. on boot, to pre-populate others' caches and detect IP conflicts
Access Port	A switchport assigned to exactly one VLAN, used for end-host connections