MAC Map

ARP Tables and Switch CAM Tables: Resolving IP to MAC and Port Bindings

How switches use CAM tables for MAC learning and routers use ARP tables to bridge Layer 2 frames to Layer 3 IP packets.

Computer networks rely on a fundamental division of labour between Layer 2 (Data Link Layer) and Layer 3 (Network Layer). Layer 3 IP addresses dictate how packets are routed across inter-connected subnets and the global Internet. However, once a packet reaches its final destination local subnet, actual physical delivery across Ethernet switches and Wi-Fi access points requires Layer 2 MAC addresses.

To bridge the gap between logical IP routing and physical frame switching, network infrastructure relies on two distinct lookup structures: Address Resolution Protocol (ARP) tables on hosts and routers, and Content Addressable Memory (CAM) tables on Ethernet switches.

Understanding how ARP and CAM tables operate—and how they differ—is essential for diagnosing connectivity failures, tracking down network hosts, and troubleshooting performance issues.

The Dual Table Mapping Framework

Although ARP tables and CAM tables both contain MAC addresses, they serve entirely different functions at different layers of the network stack:

+------------------+-----------------------+-----------------------+-----------------------+
| Table Type       | Device Type           | Core Mapping Pair     | Primary Objective     |
+------------------+-----------------------+-----------------------+-----------------------+
| ARP Table        | Hosts, Routers, L3    | IP Address to MAC      | Determine target MAC  |
| (Layer 2 / L3)   | Switches              | Address                | for IP packet frame   |
+------------------+-----------------------+-----------------------+-----------------------+
| Switch CAM Table | Layer 2 Ethernet      | MAC Address to        | Forward frame to the  |
| (Layer 2 Only)   | Switches              | Physical Switch Port  | correct switch port   |
+------------------+-----------------------+-----------------------+-----------------------+

Layer 3 to Layer 2 Mapping: The Address Resolution Protocol (ARP)

When Host A (192.168.1.50) wants to send an IP packet to Host B (192.168.1.75) on the same local subnet, Host A knows Host B’s IP address, but its network interface card cannot transmit an Ethernet frame without a target destination MAC address.

Host A consults its internal ARP table (an in-memory cache maintained by the operating system networking stack). If an entry for 192.168.1.75 exists, Host A wraps the IP packet into an Ethernet frame addressed to Host B’s MAC address and transmits it immediately.

The ARP Request and Reply Cycle

If Host A does not have Host B’s MAC address in its ARP cache, it initiates an ARP resolution sequence:

1. ARP Request (Broadcast):
   Host A broadcasts: "Who has IP 192.168.1.75? Tell 192.168.1.50"
   Frame Source MAC: Host A MAC (00:11:22:33:44:55)
   Frame Destination MAC: Broadcast (FF:FF:FF:FF:FF:FF)

2. Frame Flood:
   The switch floods the broadcast frame out all active ports on the VLAN.

3. ARP Reply (Unicast):
   Host B recognizes its IP address and responds directly to Host A:
   "192.168.1.75 is at MAC 66:77:88:99:AA:BB"
   Frame Source MAC: Host B MAC (66:77:88:99:AA:BB)
   Frame Destination MAC: Host A MAC (00:11:22:33:44:55)

4. Cache Update:
   Host A records the mapping in its local ARP cache and proceeds to transmit IP traffic.

In IPv6 networks, the IPv4 ARP broadcast mechanism is replaced by Neighbor Discovery Protocol (NDP), which uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages sent over targeted multicast addresses (FF02::1:FFxx:xxxx) rather than broadcast flooding.

Inspecting Local ARP Caches

Network engineers can view local ARP table mappings using operating system CLI tools:

  • Linux / macOS: arp -a or modern ip neighbor show
  • Windows Command Prompt / PowerShell: arp -a or Get-NetNeighbor

ARP cache entries are temporary. Operating systems purge dynamic ARP entries after a configurable timeout (typically 60 to 600 seconds) of inactivity to prevent stale IP-to-MAC mappings.

Layer 2 Physical Forwarding: Switch CAM Tables

While routers and endpoints use ARP to map IP addresses to MAC addresses, Layer 2 Ethernet switches operate without caring about IP addresses. A pure Layer 2 switch inspects only Ethernet frame headers.

To route frames efficiently between physical ports, an Ethernet switch relies on Content Addressable Memory (CAM). The switch’s CAM table (also referred to as the MAC Address Table) maps known destination MAC addresses to specific physical switch interfaces (ports) and VLAN IDs.

Switch MAC Address Table (CAM) Example:
+--------+-------------------+-----------------+--------+
| VLAN   | MAC Address       | Type            | Port   |
+--------+-------------------+-----------------+--------+
| 10     | 00:11:22:33:44:55 | Dynamic         | Gi0/1  |
| 10     | 66:77:88:99:AA:BB | Dynamic         | Gi0/12 |
| 10     | 00:50:56:99:88:77 | Dynamic         | Gi0/24 |
+--------+-------------------+-----------------+--------+

The MAC Learning Algorithm

Switches populate their CAM tables dynamically through a process called MAC learning:

  1. Ingress Inspection: When an Ethernet frame enters switch port Gi0/1, the switch hardware inspects the Source MAC Address field in the frame header.
  2. Table Recording: The switch records or refreshes an entry in its CAM table linking that Source MAC address to port Gi0/1 and the ingress VLAN.
  3. Egress Lookup: The switch then inspects the frame’s Destination MAC Address:
    • Known Unicast: If the Destination MAC exists in the CAM table for that VLAN, the switch forwards the frame only out the designated destination port (e.g., Gi0/12).
    • Unknown Unicast / Broadcast: If the Destination MAC is not present in the CAM table (or is broadcast FF:FF:FF:FF:FF:FF), the switch floods the frame out all ports belonging to that VLAN except the port where it arrived.

CAM Aging Timers and Flooding

To handle devices disconnecting or moving to different switch ports, switches enforce a MAC address table aging timer (defaulting to 300 seconds or 5 minutes on Cisco switches). If a port receives no incoming frames from a recorded MAC address before the aging timer expires, the switch drops the entry from its CAM table.

If an ARP entry exists on a router but the corresponding switch CAM entry has aged out, the switch will briefly perform unknown unicast flooding until the host sends a frame and re-arms the switch CAM table.

Inspecting Switch CAM Tables

On enterprise managed switches, administrators query the CAM table via CLI:

  • Cisco IOS / NX-OS: show mac address-table or show mac address-table dynamic
  • Arista EOS: show mac address-table
  • Juniper Junos: show ethernet-switching table

Combining ARP and CAM Tables for Host Tracking

By synthesizing data from both ARP tables and switch CAM tables, network administrators can trace an unknown host from its logical Layer 3 IP address down to its exact physical switch port location.

As detailed in our pillar guide on Identifying Unknown Network Devices, the diagnostic workflow follows a two-stage trace:

  1. Step 1 (Router ARP Query): Query the default gateway router’s ARP table for the unknown host’s IP address to obtain its active MAC address.
  2. Step 2 (Switch CAM Query): Query the central switch stack’s CAM table for that MAC address to locate the exact switch interface and access port where the device is physically cabled or wirelessly connected.

Understanding the interplay between ARP resolution and switch CAM learning provides network engineers with complete visibility over Layer 2 and Layer 3 traffic flow.