3.3 ARP and ICMP

The previous section covered routing — how packets move between networks. A gap exists: IP knows the destination IP address, and Ethernet needs a destination MAC address. ARP bridges the gap. Without ARP, no IP packet leaves the local subnet. ICMP then provides the diagnostic tools — ping and traceroute — that network engineers use to verify the layers below.

Why ARP Exists

IP operates at Layer 3. Ethernet operates at Layer 2. An IP packet requires encapsulation in an Ethernet frame to travel across a local network. An Ethernet frame requires a destination MAC address. IP only knows the destination IP address.

ARP bridges the gap. When a device sends a packet to an IP address on the same subnet, the device broadcasts an ARP request asking “who has this IP address?” The device with that IP replies with the MAC address. The sender caches the mapping and uses the mapping for subsequent packets.

Without ARP, IP communication on Ethernet is impossible. The ARP process is straightforward.

ARP Request and Reply

Key terms:

• ARP cache — a table on each device storing IP-to-MAC mappings. Entries expire after a timeout (typically 4 minutes).
• Gratuitous ARP — an ARP reply sent without a prior request. A device sends a gratuitous ARP to announce the IP-to-MAC mapping to devices on the subnet.

The ARP cache expiry has a direct consequence for MRP ring failover.

Gratuitous ARP and MRP Failover

When an MRP ring fails over, the Ring Manager sends gratuitous ARP frames. Gratuitous ARP flushes stale ARP caches across the network. Without gratuitous ARP, devices continue sending frames to the old path until the ARP entries expire — up to 4 minutes of incorrect routing.

MRP convergence time is measured in milliseconds for the ring protocol. The full application recovery time also depends on ARP cache refresh. Gratuitous ARP reduces the application recovery time to match the ring convergence time.

Platform	Command to view ARP cache
Windows	arp -a
Linux	ip neigh show
Hirschmann HiOS	Diagnostics → ARP Table

ARP resolves addresses within a subnet. ICMP provides the tools to test whether those addresses are reachable.

ICMP: Network Diagnostics

ICMP (Internet Control Message Protocol) carries messages and diagnostic information for IP. ICMP is encapsulated directly in IP packets (Protocol = 1).

ICMP Type	Name	Use
8	Echo Request	ping — test connectivity
0	Echo Reply	Response to ping
3	Destination Unreachable	Port closed or host unreachable
11	Time Exceeded	TTL expired — used by traceroute
4	Fragmentation Needed	MTU mismatch on the path

ICMP Type 3 Code 4 (Fragmentation Needed) indicates an MTU mismatch. Small packets work, but large packets do not. The mismatch causes partial connectivity: a ping succeeds but a file transfer does not. Check the MTU setting on every interface in the path. ARP conflicts are a separate class of issue that ICMP does not detect — detecting ARP conflicts requires monitoring ARP traffic directly.

Detecting ARP Conflicts

2 devices with the same IP address cause an ARP conflict. Both devices respond to ARP requests. Traffic alternates between the devices unpredictably. ARP conflicts are common when a replacement device is configured with an incorrect IP address.

The following script monitors ARP traffic and alerts when the same IP is claimed by multiple MAC addresses. Run the script on a monitoring port connected to the ring:

from scapy.all import sniff, ARP
from collections import defaultdict

ip_to_macs: dict[str, set] = defaultdict(set)

def detect_conflict(pkt):
    if not pkt.haslayer(ARP) or pkt[ARP].op not in (1, 2):
        return
    ip  = pkt[ARP].psrc
    mac = pkt[ARP].hwsrc.lower()
    if ip == "0.0.0.0":
        return
    ip_to_macs[ip].add(mac)
    if len(ip_to_macs[ip]) > 1:
        print(f"ARP CONFLICT: {ip} claimed by {ip_to_macs[ip]}")

sniff(iface="eth0", filter="arp", prn=detect_conflict, store=False)

When a conflict appears, identify both devices using the MAC addresses shown. Then correct the IP address on the replacement device.

Key Takeaways

ARP is required for IP on Ethernet

Without ARP, IP communication on Ethernet is impossible. Stale ARP entries cause brief connectivity interruptions after topology changes.

Gratuitous ARP accelerates failover recovery

MRP sends gratuitous ARP after a ring failover to flush stale ARP caches. Without gratuitous ARP, application recovery takes up to 4 minutes even though the ring recovers in milliseconds.

Use ping first, traceroute second

A successful ping confirms Layer 3 connectivity. A ping with no reply narrows the issue to Layer 3 or below. Use traceroute to find the exact hop where packets stop.

What Comes Next

ARP and ICMP complete the IP layer. The next chapter covers network redundancy — how STP, RSTP, and ring protocols handle loops and recover from link losses. Industrial-specific requirements begin to diverge sharply from standard IT networking at this layer.

References

• RFC 826 — An Ethernet Address Resolution Protocol (IETF, 1982)
• RFC 792 — Internet Control Message Protocol (IETF, 1981)
• Stevens, W. R. (1994). TCP/IP Illustrated, Volume 1. Addison-Wesley. Chapters 4 to 7.