One way is to monitor the traffic that occurs on the local network segment. There are two ways that a device can gather MAC addresses. The ARP table is maintained dynamically.The frame is then encoded onto the networking media. If this map is found in the table, the node uses the MAC address as the destination MAC in the frame that encapsulates the IPv4 packet.

O To begin the process, a transmitting node attempts to locate the MAC address mapped to an IPv4 destination. The ARP table temporarily saves (caches) the mapping for the devices on the local LAN. We call the relationship between the two values a map - it simply means that you can locate an IP address in the table and discover the corresponding MAC address. O Each entry, or row, of the ARP table binds an IP address with a MAC address. The ARP table is stored in the RAM of the device. This table is called the ARP table or the ARP cache. When a packet is sent to the data link layer to be encapsulated into a frame, the node refers to a table in its memory to find the data link layer address that is mapped to the destination IPv4 address. O For a frame to be placed on the LAN media, it must have a destination MAC address.

Arp network mac address broadcast