PING, ICMP & ARP protocols in networking — A quick insight!

PING command

The ping command stands for Packet InterNet Groper. It is a test command used to find the time taken to get a response from the sender’s IP address to the receiver’s IP address by sending packets. Do refer to the diagram below. It checks for connectivity in networks. PING command works on ICMP protocol.

This is an excellent example of PING command. If you can see, I have checked the time taken for a packet to reach from PC1 to PC 0 in the above diagram. It was successful. The computers have a successful connection.

What is a packet?

Definition: A packet is a formatted unit of data carried by a packet-switched network. When data is transmitted over a network, it’s divided into smaller, manageable pieces called packets. Each packet contains both payload (the actual data being sent) and control information (such as headers).

Components: A typical packet includes a Header: it contains control information like source and destination IP addresses, sequence numbers, and other metadata required for routing and reassembly.

Payload: The actual data being transmitted. In the case of ping, this is the data portion of the ICMP Echo Request and Reply messages.

Trailer (optional): May include error-checking information.

Another command similar to ping is the TRACERT command. Unlike the PING command where it displays the time for a packet to connect, TRACERT command looks at the exact server hops required to connect your computer to the server.

This is an excellent example of TRACERT command. If you can see, I have checked the exact server hops required to connect from PC1 to PC 0 in the above diagram. It has just over a maximum of 30 hops.

ICMP Protocol

Internet Control Message Protocol is a network layer protocol used by network devices like routers to diagnose network communication issues. ICMP is used to determine whether data is reaching its intended destination in a timely manner by sending packets. It is important for error reporting and testing. The PING command works on ICMP protocol.

An illustration of a ICMP packet

ARP — Address Resolution Protocol

ARP stands for Address Resolution Protocol. It is used to discover the data link address of a device known as the MAC address with the IP address (network layer) of the same device. Simply put, it clubs the MAC address and IP address of a device. When a device needs to communicate with another device on the same local network but only knows the target device’s IP address, it sends out an ARP request.

The ARP request is a broadcast message that asks, “Who has IP address X.X.X.X? Tell me your MAC address.”

• The device with the matching IP address responds with an ARP reply.
• The ARP reply is sent directly to the requesting device and includes the MAC address associated with the IP address.
• The requesting device updates its ARP table (or cache) with the IP-to-MAC address mapping received.
• This cached information is used for subsequent communications to avoid repeated ARP requests.

The ARP table is a list maintained by a device (such as a computer, router, or switch) that contains mappings of IP addresses to their corresponding MAC addresses. It helps the device quickly locate the MAC address of a device on the local network when it knows the IP address.

Type arp -a command in the command prompt and press enter button. After pressing the enter button, all the ARP table will display in the command prompt.

Refer at the bottom of the picture. That’s the ARP table and the command to see that is arp -a.

Types of ARP Entries

Dynamic Entries: Added automatically when an ARP reply is received in response to an ARP request. These entries have a timeout period and are removed when the timeout expires.

Static Entries: Manually configured by network administrators. These entries do not time out and are typically used for critical devices that need consistent IP-to-MAC mappings.

MAC address — Media Access Control address. A MAC address is a hardware address that uniquely identifies each device on a network. It is hardcoded into the network interface card (NIC) or adapter by the manufacturer. (Dell/Apple/HCL) MAC addresses are typically expressed as a series of hexadecimal numbers separated by colons or hyphens. The standard format is a 48-bit address, represented as 6 pairs of hexadecimal digits. For example: 00:1A:2B:3C:4D:5E. Hence, it is like a chassis number engraved on to an engine of your two-wheeler.

Source-Network Kings

And an ARP packet will consists of the following.

Source-Network Kings

There is something called a Gratuitous ARP. A gratuitous ARP (Address Resolution Protocol) request is a type of ARP message that a device sends to update other devices on the network about its own IP-to-MAC address mapping. It’s called “gratuitous” because it’s sent without being requested by another device.

Here’s a bit more detail on why and when it’s used: Self-Announcement. When a device starts up or its IP address changes, it might send a gratuitous ARP to inform other devices on the network of its new MAC address. This helps ensure that the network’s ARP tables are up-to-date. By sending a gratuitous ARP request, a device can check if another device is using the same IP address. If another device responds with the same IP but a different MAC address, it indicates an IP conflict. Overall, gratuitous ARP is a useful tool for maintaining network consistency and preventing IP address conflicts.

Keep Reading!!

Chinese proverb: “The best time to plant a tree was twenty years ago. The second best time is now.”