ICMP and ARP

The Helper Protocols

Not all protocols carry user data. Some exist solely to help other protocols do their job. ICMP and ARP are two essential helper protocols that keep networks running smoothly.

ICMP (Internet Control Message Protocol)

ICMP is used for error reporting and diagnostics. When something goes wrong at the Network Layer — a packet can't reach its destination, a router is overloaded, a TTL expires — ICMP sends a message back to the sender.

• Destination Unreachable — The packet couldn't be delivered. Maybe the host is down, the network is unreachable, or the port is closed.
• Time Exceeded — The packet's TTL (Time to Live) reached zero. This prevents packets from circulating forever in routing loops.
• Redirect — A router tells the sender to use a different router for future packets to the same destination.
• Echo Request/Reply — Used by the ping command to test connectivity.

Ping

Ping is the most common ICMP tool. It sends an Echo Request to a destination and waits for an Echo Reply. It tells you whether the destination is reachable and how long the round trip takes.

  $ ping google.com
  Pinging google.com [172.217.14.99] with 32 bytes of data:
  Reply from 172.217.14.99: bytes=32 time=15ms TTL=117
  Reply from 172.217.14.99: bytes=32 time=14ms TTL=117
  Reply from 172.217.14.99: bytes=32 time=16ms TTL=117

The time value shows the round-trip time (RTT) — how long it took for the packet to go to the destination and come back. Lower is better.

Traceroute

Traceroute (or tracert on Windows) maps the path packets take to reach a destination. It works by sending packets with increasing TTL values. Each router along the path decrements the TTL and sends an ICMP Time Exceeded message when it reaches zero.

  $ traceroute google.com
   1  192.168.1.1     1 ms    1 ms    1 ms
   2  10.0.0.1        5 ms    4 ms    5 ms
   3  72.14.200.1    12 ms   11 ms   12 ms
   4  8.8.8.8        15 ms   14 ms   15 ms
   5  172.217.14.99  18 ms   17 ms   18 ms

Each line shows one hop — a router along the path. This is invaluable for diagnosing where network problems occur.

ARP (Address Resolution Protocol)

ARP solves a fundamental problem: how does a device find the MAC address that corresponds to a known IP address?

When your computer wants to send data to another device on the same local network, it knows the destination IP address but needs the MAC address to create an Ethernet frame. ARP provides this mapping.

Here's how ARP works:

  Step 1: PC wants to send to 192.168.1.10
          Checks ARP cache — no entry found

  Step 2: PC broadcasts an ARP Request:
          "Who has 192.168.1.10? Tell 192.168.1.5"
          (Destination MAC: FF:FF:FF:FF:FF:FF = broadcast)

  Step 3: All devices receive the request, but only 192.168.1.10 responds

  Step 4: Device 192.168.1.10 sends an ARP Reply:
          "192.168.1.10 is at AA:BB:CC:DD:EE:FF"
          (Unicast — sent directly to the requesting PC)

  Step 5: PC stores the mapping in its ARP cache for future use

The ARP cache is a temporary table that stores IP-to-MAC mappings. Entries expire after a few minutes to keep the cache current.