In this session, we will communicate with your friend’s PC using the ping command and learn the mechanism of ICMP and ARP.

We introduce today’s scenario. First, sender use ARP protocol and obtain receiver’s datalink address. And next, sender’s sends ICMP requests to receiver’s PC. By monitoring its network traffic, we can see all steps of communication using L3 protocol.

Step 1. Preparation

We do not use any virtual machines. Before starting hands-on, please install Wireshark in your laptop. If you are using macOS, you can easily install it using Homebrew.

$ brew cask install wireshark

This is an example environment used in this guide.

  • Sender (your laptop)
    • OS: macOS
    • IP address: 192.168.10.100/24
    • Gateway: 192.168.10.1/24
  • Receiver (your friend’s laptop)
    • OS: macOS
    • IP address: 192.168.10.101/24
    • Gateway: 192.168.10.1/24

Step 2. Ping to Your Friends

ICMP echo

Please connect the access point we provide.

  • SSID: ap-InternetEng2018
  • Key: None

Before pinging, please check the ARP table using arp -a command and make sure that your friend’s MAC address has not been registered yet.

$ arp -a
aterm.me (192.168.10.1) at a4:12:42:94:b9:40 on en0 ifscope [ethernet]
broadcasthost (255.255.255.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]

If you have your friend’s MAC address, execute following command to clear the ARP table.

(Clear caches) You must do this at both sender and receiver.

$ sudo arp -a -d

Then, launch Wireshark and start packet capture.

Let’s ping to your friend’s laptop. Open the terminal and execute ping command.

$ ping 192.168.10.101
PING 192.168.10.101 (192.168.10.101): 56 data bytes
64 bytes from 192.168.10.101: icmp_seq=0 ttl=64 time=116.168 ms
64 bytes from 192.168.10.101: icmp_seq=1 ttl=64 time=30.049 ms
64 bytes from 192.168.10.101: icmp_seq=2 ttl=64 time=52.527 ms
64 bytes from 192.168.10.101: icmp_seq=3 ttl=64 time=96.263 ms
64 bytes from 192.168.10.101: icmp_seq=4 ttl=64 time=90.539 ms
64 bytes from 192.168.10.101: icmp_seq=5 ttl=64 time=112.501 ms
64 bytes from 192.168.10.101: icmp_seq=6 ttl=64 time=44.624 ms
^C
--- 192.168.10.101 ping statistics ---
7 packets transmitted, 7 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 30.049/77.524/116.168/32.068 ms

To communicate with your friend in the same datalink, you have to know your friend’s MAC address. So, after sending ICMP packets with ping, your friend’s IP address and corresponding MAC address will be registered in your ARP table.

$ arp -a
aterm.me (192.168.10.1) at a4:12:42:94:b9:40 on en0 ifscope [ethernet]
? (192.168.10.101) at f0:79:60:1b:ab:58 on en0 ifscope [ethernet]
? (192.168.10.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
broadcasthost (255.255.255.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]

Then, stop packet capture. Do not close the Wireshark screen.

Step 3. Check ARP Packets

For sending ICMP packets to the destination host (receiver) in the same datalink, the sender needs to know the destination’s MAC address. Therefore the sender broadcasts the ARP request to every host in the same datalink and requests receiver’s MAC address.

arp

Resolved datalink address is used for communication between hosts in same datalink. You can display only ARP packets filtering arp on Wireshark.

arp-wireshark-req

This is a ARP request packet. In ARP requests, sender PC can request MAC address of receiver PC by specifying its IP address.

arp-wireshark-reply

This is a ARP reply packet. In ARP replies, receiver’s PC replies and inform its MAC address to sender’s PC.

Step 4. Check ICMP Packets

These are ICMP echo packets. The receiver’s MAC address resolved by ARP is set in Ethernet header.

icmp-echo-wireshark