When you ping a server on the internet, why does ARP resolve the default gateway's MAC and not the server's MAC?
Because Ethernet only delivers within the local LAN. To leave the LAN, your packet must first reach the gateway — so the gateway's MAC is what the Ethernet frame needs.
The journey of a packet:
- App: "Send this to
8.8.8.8" - OS routing table: "8.8.8.8 isn't on my LAN → use default gateway 192.168.1.1"
- ARP: "What's the MAC of 192.168.1.1?" → e.g.
AA:BB:CC:11:22:33 - Frame is built: dest MAC = gateway, dest IP = 8.8.8.8
- Gateway receives the frame, strips the Ethernet header, looks at the IP, forwards toward the next hop
Layered addressing:
| Layer | What it knows |
|---|---|
| Ethernet (L2) | "Deliver this frame to the next physical device" |
| IP (L3) | "Deliver this packet to the final destination" |
So the IP destination stays 8.8.8.8 end-to-end, but the MAC destination changes at every hop (your PC → router → ISP router → … → Google's server).
Implication for the ARP cache:
For internet-bound traffic, you'll never see the destination server's MAC in your ARP cache — you'll always see your default gateway's MAC. This is how you can verify "is the destination on my LAN or outside it?"
Tip: This is why misconfiguring the default gateway breaks all internet access immediately — without a known gateway MAC, no packet can leave the LAN.