Chapter 6 — Session 8: IP, ICMP, ARP & RARP


Now we’re entering the Internet layer of the TCP/IP/DoD model.

This session is important because it connects several things you’ve already learned:

IP = logical addressing + routing
ICMP = network messages/errors
ARP = IP → MAC
RARP = MAC → IP

Your Chapter 6 source identifies these as Internet-layer protocols, along with GRE and IPSec, which we’ll save for the next session so this one doesn’t get overloaded.

📋 Topics to Mark Off

  • ⬜ Internet Layer

  • ⬜ Internet Protocol — IP

  • ⬜ Logical Addressing

  • ⬜ Routing

  • ⬜ Routing Table

  • ⬜ Destination IP Address

  • ⬜ TTL — Time To Live

  • ⬜ ICMP

  • ⬜ ICMP Network Messages

  • ⬜ Destination Unreachable

  • ⬜ Ping

  • ⬜ ICMP Echo Request

  • ⬜ ICMP Echo Reply

  • ⬜ Traceroute / tracert

  • ⬜ ARP

  • ⬜ ARP Cache

  • ⬜ ARP Broadcast

  • ⬜ IP → MAC

  • ⬜ RARP

  • ⬜ MAC → IP

  • ⬜ ARP vs. RARP

🛣 1. Internet Layer

Remember our TCP/IP model?

Process/Application
        ↓
Host-to-Host
        ↓
INTERNET  👈 WE ARE HERE
        ↓
Network Access

The Internet layer's biggest responsibility is:

Routing

Your chapter says routing belongs entirely to this layer, and IP provides the interface between the upper layers and different network-access technologies.

🧠 Memory

Internet Layer = IP + Routing

🌐 2. IP — Internet Protocol

IP is basically the star of the Internet layer.

Your source goes as far as saying:

IP is essentially the Internet layer.

IP looks at the packet's destination IP address, checks its routing information, and determines where that packet should go next.

Think:

📦 Packet Destination: 10.20.30.40 ↓ 🌐 IP "Where does this packet need to go next?" ↓ 🛣️ Routing Table

📍 Logical Addressing

Every host has a:

Logical address = IP address

This is different from a MAC address.

IP address

Think:

Where on the network?

MAC address

Think:

Which physical interface/device on the local network?

Your chapter compares the logical address to finding the right street and the hardware address to finding the right mailbox.

🧠 Memory

IP = Where

MAC = Who locally

🛣 Routing Table

IP examines the destination address and uses the:

Routing table

to determine the next/best path.

Conceptually:

Destination:
10.30.40.50

       ↓

🛣️ Routing Table

10.0.0.0 → Router A
20.0.0.0 → Router B
30.0.0.0 → Router C

       ↓

Forward packet

🧠

Routing table = directions for packets

⏱ TTL — Time To Live

An IP packet contains a field called:

TTL — Time To Live

TTL prevents packets from endlessly bouncing around a network.

Your source says that if the packet doesn't reach its destination before TTL expires, it is discarded.

Think:

Packet TTL = 3

Router 1
↓
2

Router 2
↓
1

Router 3
↓
0

💀 Packet discarded

🧠 Memory

TTL = Packet expiration counter

📣 3. ICMP — Internet Control Message Protocol

ICMP = Internet Control Message Protocol

ICMP works at the Network/Internet layer and provides:

Management and messaging services for IP

ICMP messages themselves are carried inside IP packets.

Think:

ICMP = IP's messenger

🚨 ICMP Reports Network Problems

Suppose a router can't deliver a packet.

The router can send an ICMP message back to the sender saying:

"I couldn't get this there."

One important example is:

Destination Unreachable

Your chapter specifically describes routers using ICMP Destination Unreachable when an IP datagram can't be forwarded further.

🏓 4. Ping

You already know the command:

ping 192.168.1.1

But now understand what's happening underneath.

Ping uses ICMP

Specifically:

ICMP Echo Request
        ↓
Destination
        ↓
ICMP Echo Reply

Your source says Ping uses ICMP echo request and reply messages to check physical and logical connectivity.

🧠 Memory

Ping = ICMP

🏓 Ping Mental Picture

💻 Computer A "Are you there?" ICMP Echo Request ↓ ↓ ↓ 🖥️ Computer B "Yep." ICMP Echo Reply

If CompTIA asks:

Which protocol is used by Ping?

✅ ICMP

🗺 5. Traceroute / tracert

Traceroute determines:

The path packets take through an internetwork

Your chapter says traceroute uses IP packet TTL timeouts to discover that path. Windows calls the command:

tracert

Example:

Your PC
   ↓
Router 1
   ↓
Router 2
   ↓
Router 3
   ↓
Server

Traceroute helps reveal those hops.

🆚 Ping vs. Traceroute

Keep these separate:

Ping

Can I reach it?

Traceroute

What path am I taking to reach it?

PING
=
Connectivity


TRACEROUTE
=
Path / hops

📬 6. ARP — Address Resolution Protocol

This is a BIG one.

ARP = Address Resolution Protocol

ARP takes a known:

IP address

and finds the corresponding:

MAC address

Your source describes ARP as translating the software/logical IP address into the local hardware/MAC address.

🧠 KNOW THIS COLD

ARP = IP → MAC

🏠 Why Do We Need ARP?

Imagine your computer knows:

Destination IP:
192.168.1.50

But to send an Ethernet frame on the local LAN, it also needs the destination:

MAC Address:
??:??:??:??:??:??

So it uses ARP.

192.168.1.50
     ↓
    ARP
     ↓
AA:BB:CC:DD:EE:FF

📢 ARP Broadcast

First, the computer checks its:

ARP cache

If it already knows the MAC address, great.

If not, ARP sends a broadcast onto the local network asking:

"Who has this IP address?"

Your source specifically describes ARP broadcasting on the local network when the hardware address isn't already in the ARP cache.

Think:

💻 Computer: "WHO HAS 192.168.1.50?!" 📢 ARP Broadcast ↙ ↓ ↘ 💻 💻 💻

The correct host responds with its MAC address.

🧠 ARP Cache

Your device doesn't want to broadcast every single time.

So it keeps recently learned mappings in an:

ARP Cache

Think:

IP Address       MAC Address

192.168.1.10  →  AA:11:...
192.168.1.20  →  BB:22:...
192.168.1.50  →  CC:33:...

🧠 Memory

ARP cache = saved IP-to-MAC mappings

🔄 7. RARP — Reverse Address Resolution Protocol

Now flip ARP around.

ARP

IP
↓
MAC

RARP

MAC
↓
IP

RARP = Reverse ARP

Your chapter describes RARP as historically allowing a diskless machine that knows its MAC address but not its IP address to request the IP associated with that MAC.

🧠 Memory

ARP = IP → MAC

RARP = MAC → IP

🚨 EXAM TRAP

Don't flip these:

ARP
IP → MAC


RARP
MAC → IP

Think:

R = Reverse it

⭐ Put It All Together

Suppose your computer needs to send data to another local machine.

Destination IP known
192.168.1.50
        ↓
Check ARP cache
        ↓
MAC known?
   ↙          ↘
 YES          NO
 ↓             ↓
Use MAC    ARP Broadcast
              ↓
          Learn MAC
              ↓
          Send frame

That's ARP in action.

🚨 EXAM SCENARIO #1

A computer knows the IP address of another device on its local LAN but needs its MAC address.

Which protocol?

✅ ARP

🚨 EXAM SCENARIO #2

A technician wants to determine whether another host is reachable.

Which utility/protocol combination?

✅ Ping using ICMP

🚨 EXAM SCENARIO #3

A technician wants to see the routers a packet crosses before reaching a destination.

Think:

✅ Traceroute / tracert

🚨 EXAM SCENARIO #4

A packet keeps bouncing through a routing loop.

Which IP field prevents it from circulating forever?

✅ TTL

🎴 Flashcards

⭐ 1 — EXAM GOLD

Which TCP/IP layer is responsible for routing packets between networks?

A. Network Access
B. Host-to-Host
C. Internet
D. Process/Application

✅ Internet

⭐ 2

What type of address does IP use for routing?

A. Hardware/MAC address

B. Logical IP address

C. Port number

D. VLAN ID

✅ Logical IP address

⭐ 3

What does IP use to determine where a packet should be sent next?

A. ARP cache

B. Routing table

C. DNS cache

D. DHCP lease

✅ Routing table

⭐ 4 — EXAM GOLD

What is the purpose of the IP TTL field?

A. Encrypt packets

B. Resolve IP addresses

C. Prevent packets from circulating forever

D. Assign MAC addresses

✅ C

⭐ 5

Which protocol provides network-management and error messaging for IP?

A. ARP

B. ICMP

C. TCP

D. FTP

✅ ICMP

⭐ 6 — Scenario

A router cannot forward an IP datagram and needs to notify the sending host.

Which protocol can provide the error message?

A. ARP

B. UDP

C. ICMP

D. FTP

✅ ICMP

⭐ 7 — EXAM GOLD

Which protocol does Ping use?

A. TCP

B. UDP

C. ICMP

D. ARP

✅ ICMP

⭐ 8

Which ICMP messages are commonly used by Ping?

A. SYN and ACK

B. Echo Request and Echo Reply

C. Discover and Offer

D. Request and Acknowledge

✅ B

⭐ 9

What is the primary purpose of Ping?

A. Discover every router in a path

B. Test connectivity to another host

C. Translate IP addresses to MAC addresses

D. Assign network configuration

✅ B

⭐ 10

What is the primary purpose of traceroute/tracert?

A. Resolve DNS names

B. Discover the path a packet takes through the network

C. Transfer files

D. Assign IP addresses

✅ B

⭐ 11

Which IP field does traceroute use to help reveal the path through an internetwork?

A. Source port

B. MAC address

C. TTL

D. FCS

✅ TTL

⭐ 12 — EXAM GOLD

What does ARP resolve?

A. MAC → IP

B. IP → MAC

C. Hostname → IP

D. Port → Protocol

✅ IP → MAC

⭐ 13 — Scenario

A workstation knows that the destination is 192.168.1.30 but does not know its Ethernet hardware address.

Which protocol can discover the MAC address?

A. DNS

B. DHCP

C. ARP

D. ICMP

✅ ARP

⭐ 14

What does a host check before sending an ARP broadcast?

A. DNS zone

B. ARP cache

C. DHCP scope

D. Routing protocol database

✅ ARP cache

⭐ 15

Why does ARP send a broadcast?

A. To synchronize clocks

B. To ask the local network which device owns a particular IP address

C. To establish a TCP connection

D. To encrypt a frame

✅ B

⭐ 16 — EXAM GOLD

What does RARP resolve?

A. MAC → IP

B. IP → MAC

C. Hostname → IP

D. TCP → UDP

✅ MAC → IP

⭐ 17

Which comparison between ARP and RARP is correct?

A. Both resolve hostnames.

B. ARP maps IP to MAC, while RARP maps MAC to IP.

C. ARP maps MAC to IP, while RARP maps IP to MAC.

D. Both provide routing.

✅ B

⭐ 18 — Scenario

A legacy diskless machine knows its MAC address but needs to determine its IP address.

Which protocol from this chapter performs that function?

A. ARP

B. RARP

C. ICMP

D. TCP

✅ RARP

🧠 Memory Board

🌐 INTERNET LAYER = IP + ROUTING 📦 IP Logical addressing Routing table Destination IP ⏱️ TTL Packet expiration counter Stops endless loops 📣 ICMP IP's messenger Network errors + Management messages 🏓 PING ICMP Echo Request ICMP Echo Reply "Can I reach you?" 🗺️ TRACEROUTE Shows path / hops Uses TTL timeouts 📬 ARP IP → MAC Check ARP cache ↓ If unknown ↓ Broadcast 🔄 RARP MAC → IP R = Reverse

🎯 Know These Cold

Internet Layer = Routing

IP = Logical addressing + packet routing

IP uses the destination address and routing table to choose the next path

TTL prevents packets from circulating forever

ICMP = Network messaging/errors for IP

Ping = ICMP Echo Request / Echo Reply

Traceroute = Shows the path/hops and uses TTL behavior

ARP = IP → MAC

ARP checks the ARP cache before broadcasting

ARP broadcasts on the local network when it doesn't know the MAC

RARP = MAC → IP

The next session should be Session 9: GRE, IPSec, AH, ESP & IKE. Those belong together because your source directly connects GRE tunneling with IPSec security and then breaks IPSec into AH, ESP, and IKE.




ARP finds a MAC from a known IP; RARP reverses that direction.

🧠 ARP: IP → MAC. RARP: MAC → IP. R = Reverse it.


The ARP cache stores recently learned IP-to-MAC mappings so a host does not need to broadcast every time.
🧠 ARP cache = saved IP-to-MAC mappings.