ARP, the default gateway and ping

Why ARP?

Applications use IP addresses, but an Ethernet frame needs a destination MAC address. ARP (Address Resolution Protocol) is the bridge between them: it finds the MAC address that belongs to an IPv4 address on the local network. (IPv6 uses a different method, Neighbor Discovery, covered later.)

Local or remote? The first decision

Before sending, a PC compares the destination IP address with its own IP address and subnet mask. If the destination is in the same network, it delivers the frame directly to that host. If not, it sends the frame to its default gateway, the router that leads out of the local network, and the router carries the packet onward.

import ipaddress

me = ipaddress.ip_interface("192.168.1.10/24")
for dst in ["192.168.1.55", "8.8.8.8"]:
    if ipaddress.ip_address(dst) in me.network:
        print(dst, "is local: ARP for", dst)
    else:
        print(dst, "is remote: ARP for the gateway 192.168.1.1")

So for a remote destination, the PC ARPs for the MAC of the gateway, not the far server. The frame carries the gateway MAC, while the packet inside still carries the far server IP address.

How ARP works

1. ARP request: the PC broadcasts a frame to ffff.ffff.ffff saying "Who has 192.168.1.1? Tell 192.168.1.10". Every device in the LAN receives it.
2. Every device also notes the sender IP and MAC from the request, if it already has an entry or is the target.
3. ARP reply: only the owner of 192.168.1.1 answers, with a unicast frame straight back: "192.168.1.1 is at 0011.2233.4401".
4. The PC stores the answer in its ARP cache (ARP table) so it does not have to ask before every packet.

Entries expire after a while: Cisco routers keep them for 4 hours by default, while Windows and Linux keep them for much less (seconds to minutes). Gratuitous ARP is an ARP that a device sends about its own address, for example when it boots, so others update their caches.

C:\> arp -a
Interface: 192.168.1.10 --- 0x7
  Internet Address      Physical Address      Type
  192.168.1.1           00-11-22-33-44-01     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static

Router# show ip arp
Protocol  Address        Age (min)  Hardware Addr   Type   Interface
Internet  192.168.1.1         -     0011.2233.4401  ARPA   GigabitEthernet0/0
Internet  192.168.1.10        3     00aa.bbcc.dd10  ARPA   GigabitEthernet0/0

ICMP and ping

ICMP (Internet Control Message Protocol) carries error and test messages for IP. Ping sends ICMP echo request messages and waits for echo replies. It reports whether replies came back and the round trip time. Traceroute (tracert on Windows) also uses ICMP replies to show each router on the path.

On a Cisco device, ping shows one character per probe: ! for a reply, . for a timeout and U for unreachable. The first ping to a new neighbour often shows .!!!! because the first probe was lost while ARP did its work.