Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Rhinorhino on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Ping question - ARP and ICMP
- Thread starter surfbum99
- Start date
CiscoGuy33
Instructor
surfbum99,
You are correct - to send a "ping packet" you need two things - an IP address which you have "ping 192.168.1.1"
and you need the MAC address of the next hop on the way to 192.168.1.1.
The destination and source MAC addresses will change with each hop as the layer 2 frame is broken down and then rebuilt to carry the packet on the next leg (encapsulation).
To get the MAC address - when the command "ping 192.168.1.1" is issued the device checks the ARP cache 1st and if not there it will send the ARP request.
This is why when you test this on most Cisco routers - the 1st ping request will time out (waiting for the ARP info)
and the rest will succeed. If you run the same ping command again you should get 100% because that MAC address is now in the cache.
You can view the ARP cache before and after to see that it has a new listing.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
You are correct - to send a "ping packet" you need two things - an IP address which you have "ping 192.168.1.1"
and you need the MAC address of the next hop on the way to 192.168.1.1.
The destination and source MAC addresses will change with each hop as the layer 2 frame is broken down and then rebuilt to carry the packet on the next leg (encapsulation).
To get the MAC address - when the command "ping 192.168.1.1" is issued the device checks the ARP cache 1st and if not there it will send the ARP request.
This is why when you test this on most Cisco routers - the 1st ping request will time out (waiting for the ARP info)
and the rest will succeed. If you run the same ping command again you should get 100% because that MAC address is now in the cache.
You can view the ARP cache before and after to see that it has a new listing.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
- Thread starter
- #3
mm thanks for this thats what I thought. But alot of people are confused whether to put it down in an exam question.
Q. Which of the following protocols does "ping" use? [Choose all that apply]
* SMTP
* ARP
* SNMP
* ICMP
* OSPF
People saying "ping" doesn't actually for itself "use" arp, as far as its concerned its lower down the IP stack. And doesn't need to know about it.
So its a difference of opinion I think. But I think I would still pick both ARP and ICMP, not just ICMP on its own.
Q. Which of the following protocols does "ping" use? [Choose all that apply]
* SMTP
* ARP
* SNMP
* ICMP
* OSPF
People saying "ping" doesn't actually for itself "use" arp, as far as its concerned its lower down the IP stack. And doesn't need to know about it.
So its a difference of opinion I think. But I think I would still pick both ARP and ICMP, not just ICMP on its own.
CiscoGuy33
Instructor
surfbum99,
I have never seen a real Cisco exam with a question in the [Choose all that apply] format that had only one answer, in fact on those questions - unless they have changed recently they always said the number of answers they were looking for.
In a 1 answer question - it would be ICMP if they said pick 2 answers - I would pick ICMP and ARP.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
I have never seen a real Cisco exam with a question in the [Choose all that apply] format that had only one answer, in fact on those questions - unless they have changed recently they always said the number of answers they were looking for.
In a 1 answer question - it would be ICMP if they said pick 2 answers - I would pick ICMP and ARP.
Hope this helps!
E.A. Broda
CCNA, CCDA, CCAI, Network +
- Status
Similar threads
- Locked
- Question
- Locked
- Question