ARP and ICMP

Two protocols that keep IPv4 usable

IP can forward a packet only when the next hop’s link-layer address is known, and operators need a lightweight way to test reachability when something fails. ARP solves the mapping problem on Ethernet. ICMP carries diagnostic and error feedback. HCIA-Datacom treats both as core Internet-layer helpers—do not confuse them with transport protocols.

ARP: Address Resolution Protocol

When a host or router must send an IPv4 packet to a destination on the same subnet, the frame’s destination MAC must be that neighbor’s MAC (or the gateway’s MAC if the destination is remote). If the mapping is not already cached, ARP discovers it:

1. Sender builds an ARP request: “Who has IP X.X.X.X? Tell MAC Y.”
2. The request is sent as an Ethernet broadcast (FF:FF:FF:FF:FF:FF) so every node on the VLAN hears it.
3. The owner of IP X replies with an ARP reply unicast to the requester, containing its MAC.
4. Both sides typically cache the binding in an ARP table for a finite lifetime.

Key properties:

Same-subnet vs remote-subnet behavior

• Same subnet: ARP for the destination IP directly.
• Different subnet: ARP for the default gateway IP; the gateway then routes and performs ARP on the next hop. A classic exam trap is assuming the host ARPs for a remote server’s IP—it does not, unless proxy ARP is in play (unusual in clean designs).

Gratuitous ARP

A gratuitous ARP is an ARP message a host sends about its own IP address, often as a request with the target IP equal to the sender’s IP, or as an unsolicited reply. Uses include:

• Announcing a new MAC after NIC change or VRRP/HRP failover so switches update CAM tables quickly.
• Detecting IP address conflicts (another host replies unexpectedly).
• Updating neighbors after DHCP renumbering.

Proxy ARP (awareness only)

A router configured for proxy ARP may answer ARP requests for remote IPs with its own MAC. That can mask misconfigured masks but creates fragile designs. Prefer correct subnetting and explicit gateways; know the concept so you can explain odd ARP replies on a router.

ARP tables on hosts and Huawei devices

Hosts store learned IP–MAC pairs. Switches learn MACs for forwarding independently; routers and Layer 3 interfaces keep ARP for next-hop resolution.

On Huawei VRP, the everyday commands are:

<Huawei> display arp
<Huawei> display arp interface GigabitEthernet0/0/1
<Huawei> display arp dynamic
<Huawei> display arp static

Typical fields include IP address, MAC address, interface, VLAN/type, and aging information. Dynamic entries appear after successful resolution; static entries remain until removed.

Clear stale mappings when a device changes NIC or after a duplicate-IP event:

<Huawei> reset arp all
<Huawei> reset arp interface GigabitEthernet0/0/1

Troubleshooting pattern:

1. ping the neighbor or gateway.
2. If ping fails, display arp and confirm an entry exists for the target or gateway.
3. Check VLAN membership, access/trunk mode, and that both devices share the same subnet mask.
4. Clear ARP and retest if a MAC changed but the old binding remains.

Do not confuse display arp with display mac-address. The MAC table answers “which port is this MAC on?” ARP answers “which MAC owns this IP?”

ICMP: Internet Control Message Protocol

ICMP rides with IP and carries control and error messages. It is not a transport for application payloads the way TCP/UDP are, though utilities like ping use it deliberately.

Important message types for HCIA-Datacom:

How ping works

The ping utility sends ICMP echo request messages and expects echo reply messages. Success proves:

• Basic IP connectivity to the destination (or at least to a device that answers for it).
• That intermediate devices are not silently dropping those ICMP types (some firewalls do).

Failure modes to separate mentally:

• Request timeout — no reply; could be down path, filtering, or ARP failure on the local hop.
• Destination unreachable — a router on the path returned ICMP type 3 with a code explaining why.
• TTL expired in transit — path loop or excessively low TTL.

On Huawei VRP:

<Huawei> ping 192.168.10.1
<Huawei> ping -c 5 -s 100 10.1.1.1

Options vary by software version; know that ping is the first-line reachability test after addressing and ARP look healthy.

How tracert works

Tracert (Huawei’s traceroute spelling) maps the path:

1. Send probes with TTL = 1. The first hop decrements TTL to 0, drops the packet, and returns ICMP Time Exceeded.
2. Send probes with TTL = 2 to learn the second hop.
3. Continue until the destination answers (often with port unreachable for UDP-based traceroute, or echo reply for ICMP-based variants) or the max hop count is reached.

On Huawei:

<Huawei> tracert 8.8.8.8

Each line shows a hop address and latency. Asterisks mean that hop did not return ICMP time-exceeded (filtering) even if forwarding still works—interpret missing hops carefully.

ARP vs ICMP: exam traps

Common wrong answers:

• Using DNS when the host already has the IP but not the MAC.
• Claiming ICMP resolves addresses—ICMP does not map IP to MAC.
• Expecting ARP to work across routers without relay/proxy (normal ARP does not cross L3 boundaries).
• Assuming a failed ping always means “remote host down” when local ARP or ACL issues are more likely.

Integrating with Huawei campus troubleshooting

A practical order of checks on VRP:

1. display ip interface brief — is the interface up with the expected IP?
2. display arp — is the next hop or peer resolved?
3. ping — does ICMP echo succeed?
4. tracert — where does the path stop?
5. Deeper tools (display ip routing-table, ACLs, NAT) once L2 mapping and basic ICMP are understood.

ARP and ICMP will reappear when you study VLANIF gateways, OSPF neighbors (indirectly via reachability), DHCP conflicts, and WLAN CAPWAP path validation. Treat them as permanent tools in the HCIA kit, not one-off theory.