IP Address Resolution (Mapping IP Address to Link Layer Address)

Many people are familiar with the mapping from domain nodename (e.g. www.sixscape.com) to IP address (e.g., and/or 2001:db8:1:2::1000). This mapping is done by DNS in the Application Layer (OSI Layer 7). IP packets contain IP addresses, not domain nodenames.

There is a second mapping from IP address (OSI Layer 3) to Link Layer address (OSI Layer 2) which with Ethernet is a MAC address). There is no server similar to DNS for this mapping. This mapping takes place inside the TCP/IP stack. This  is called IP address resolution.

Ethernet cannot deliver data by IP address – it has its own addressing scheme, using 48 bit MAC addresses. Every Ethernet compliant network device (e.g. NIC) has a unique MAC address (usually burned into it by the manufacturer). There are both unicast and multicast Ethernet addresses.

48 bit unicast MAC addresses have two parts. The first 24 bits is called the OUI (Organizationally Unique Identifier). Companies that make network hardware have one or more OUIs assigned.  For example, ASUSTek owns the OUI 00:22:15. The last 24 bits are assigned by the company that owns the OUI. The means the company can produce up to 224 (16,777,216) devices for that OUI. If they produce more than that, they can get additional OUIs. The only rule for the low 24 bits is that it must be unique within the OUI (it does not need to be issued in numeric sequence). These rules insure that each 48 bit MAC address is globally unique.

There is no way to tell from a MAC address what organization owns that device, what network it is used in, or what its geographic location is. This is why IP addresses, which do indicate what network a node is in, must be layered on top of MAC addresses.

MAC addresses, like IP addresses are really just an ordered sequence of bits internally. For humans to read and enter, they are represented as 6 groups of 8 bits, separated by either “:” or “-” (either is acceptable). Each 8 bit group is represented by two hexadecimal (base 16) digits. So, a typical MAC address might look like: 00:22:15:24:32:9c. In ipconfig (in Windows), this address is called the “Physical Address”.

Both IPv4 and IPv6 must do address resolution to map IP addresses onto Link Layer addresses. IPv4 uses ARP (the Address Resolution Protocol), while IPv6 uses Neighbor Discovery Address Resolution.