Why Adapter ARPs Known Addresses – Ethernet Analysis

I am assuming you're using "bridge-mode" for networking (your internal, virtual adapter is bridged to your host's physical adapter).

In any case (unless you explicitlly manually set them to the same address, which causes a lot of other problems), your guest (WinXP) machine will have a different MAC address than your host (CentOS). Due to bridge-mode, your host acts as an ethernet switch, and forwards packets to the guest.

So when an ARP broadcast comes, your host gets the packet and also forwards it to your guest machine. When packets for your host come, they are processed by your host's network stack. When packets for your guest come, the host forwards them to your guest, which then processes them as needed.

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and port number. Switches follow this simple algorithm for forwarding packets:

1. When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the port number the packet was received on. In this way, the switch learns the MAC address and port of every transmitting device.

2. The switch then compares the DESTINATION MAC address with the table. If there is an entry, the switch forwards the frame out the associated port. If there is no entry, the switch sends the packet out all its ports, except the port that the frame was received on (Flooding).

Note that the switch does not learn the destination MAC until it receives a frame from that device.