3.3 ARP and ICMP

The previous section covered routing — how packets move between networks. But there is a gap: IP knows the destination IP address, and Ethernet needs a destination MAC address. ARP bridges this gap. Without ARP, no IP packet can leave the local subnet. ICMP then provides the diagnostic tools — ping and traceroute — that every network engineer uses to verify that the layers below are working.

Why ARP Exists

IP operates at Layer 3. Ethernet operates at Layer 2. An IP packet must be encapsulated in an Ethernet frame to travel across a local network. An Ethernet frame requires a destination MAC address. But IP only knows the destination IP address.

ARP bridges this gap. When a device wants to send a packet to an IP address on the same subnet, it broadcasts an ARP request asking “who has this IP address?” The device with that IP replies with its MAC address. The sender caches the mapping and uses it for subsequent packets.

Without ARP, IP communication on Ethernet is impossible. The ARP process itself is straightforward.

ARP Request and Reply

Key terms:

• ARP cache — a table on each device storing IP-to-MAC mappings; entries expire after a timeout (typically 4 minutes)
• Gratuitous ARP — an ARP reply sent without a prior request; a device sends it to announce its IP-to-MAC mapping to all devices on the subnet

The ARP cache expiry has a direct consequence for MRP ring failover.

Gratuitous ARP and MRP Failover

When an MRP ring fails over, the Ring Manager sends gratuitous ARP frames. This flushes stale ARP caches across the network. Without gratuitous ARP, devices would continue sending frames to the old path until their ARP entries expire — up to 4 minutes of incorrect routing.

This is why MRP convergence time is measured in milliseconds for the ring protocol itself, but the full application recovery time also depends on ARP cache refresh. Gratuitous ARP reduces the application recovery time to match the ring convergence time.

Platform	Command to view ARP cache
Windows	arp -a
Linux	ip neigh show
Hirschmann HiOS	Diagnostics → ARP Table

ARP resolves addresses within a subnet. ICMP provides the tools to test whether those addresses are reachable.

ICMP: Network Diagnostics

ICMP (Internet Control Message Protocol) carries error messages and diagnostic information for IP. It is encapsulated directly in IP packets (Protocol = 1).

ICMP Type	Name	Use
8	Echo Request	ping — test connectivity
0	Echo Reply	Response to ping
3	Destination Unreachable	Port closed or host unreachable
11	Time Exceeded	TTL expired — used by traceroute
4	Fragmentation Needed	MTU mismatch on the path

ICMP Type 3 Code 4 (Fragmentation Needed) indicates an MTU mismatch. Small packets work but large ones do not. This causes mysterious partial connectivity: a ping succeeds but a file transfer fails. Check the MTU setting on all interfaces in the path. ARP conflicts are a separate class of problem that ICMP cannot detect — they require monitoring the ARP traffic directly.

Detecting ARP Conflicts

Two devices with the same IP address cause an ARP conflict. Both respond to ARP requests. Traffic alternates between them unpredictably. This is a common problem when a replacement device is configured with the wrong IP address.

The following script monitors ARP traffic and alerts when the same IP is claimed by multiple MAC addresses. Run it on a monitoring port connected to the ring:

from scapy.all import sniff, ARP
from collections import defaultdict

ip_to_macs: dict[str, set] = defaultdict(set)

def detect_conflict(pkt):
    if not pkt.haslayer(ARP) or pkt[ARP].op not in (1, 2):
        return
    ip  = pkt[ARP].psrc
    mac = pkt[ARP].hwsrc.lower()
    if ip == "0.0.0.0":
        return
    ip_to_macs[ip].add(mac)
    if len(ip_to_macs[ip]) > 1:
        print(f"ARP CONFLICT: {ip} claimed by {ip_to_macs[ip]}")

sniff(iface="eth0", filter="arp", prn=detect_conflict, store=False)

When a conflict appears, identify both devices using the MAC addresses shown, then correct the IP address on the replacement device.

Key Takeaways

ARP is required for IP on Ethernet

Without ARP, IP communication on Ethernet is impossible. Stale ARP entries cause brief connectivity interruptions after topology changes.

Gratuitous ARP accelerates failover recovery

MRP sends gratuitous ARP after a ring failover to flush stale ARP caches. Without it, application recovery takes up to 4 minutes even though the ring recovers in milliseconds.

Use ping first, traceroute second

A successful ping confirms Layer 3 connectivity. A failed ping narrows the problem to Layer 3 or below. Use traceroute to find the exact hop where packets stop.

What Comes Next

ARP and ICMP complete the IP layer. The next chapter covers network redundancy — how STP, RSTP, and ring protocols prevent loops and recover from failures. This is where the industrial-specific requirements begin to diverge sharply from standard IT networking.

References

• RFC 826 — An Ethernet Address Resolution Protocol (IETF, 1982)
• RFC 792 — Internet Control Message Protocol (IETF, 1981)
• Stevens, W. R. (1994). TCP/IP Illustrated, Volume 1. Addison-Wesley. Chapters 4 to 7.