• Due to encapsulations, the source/dest IP addresses are hidden in an ethernet frame.
  • The sending device sends out a ARP to FF-FF-FF-FF-FF-FF (universal broadcast address) asking for the MAC address associated with an IP address.
  • Once the sending device has the MAC address for the receiving device it starts sending unicast frames.
  • You can run arp -a to see OS' current ARP cache.