is a standard utility program available on most computers. A ping utility sends test messages from the computer to a remote device over a TCP/IP network. Besides determining whether the remote computer is currently online, ping also provides indicators of the general speed or reliability of network connections.
Everybody knows that the ping utility is used to check network connectivity between two hosts, but what happens when a user issues a ping? This article is designed to explain the basics of what happens on a network when a ping is issued. Imagine the following scenario;
You have PC-A in subnet 192.168.1.0/24, PC-B in subnet 192.168.2.0/24 and a router connected to both subnets. You need to check if PC-A can connect to PC-B.
IP addresses and MAC addresses to state with examples:
192.168.1.10 MAC Address 00:00:00:00:00:10
Default Gateway 192.168.1.15
Router Interface E0
192.168.1.15 MAC Address 00:00:00:00:00:15
Router Interface E1
192.168.2.20 MAC Address 00:00:00:00:00:20
192.168.2.25 MAC Address 00:00:00:00:00:25
Default Gateway 192.168.2.20
A user on PC-A types in “ping 192.168.2.25”
The first thing happens ICMP creates data (an alphabet). IP on PC-A creates a packet containing Destination IP Address
192.168.2.25, the Source IP Address
192.168.1.10, the data, and a protocol field. The protocol field informs the receiving host where to pass the data to, in this example the protocol field would be set to 0x1h to indicate ICMP. (0x indicates that the following is an hexadecimal number).
Once the packet been created ARP (Address Resolution Protocol) is then used to identify the MAC address of the destination host. This can happen in a number of ways, the first to happen is that ARP checks it’s cache to see if it has a match to the Destination IP Address. If not then ARP sends out an ARP broadcast to the Ethernet MAC broadcast address
“Who has 192.168.2.25? Please tell 000000000010”?
You will notice that PC-A is asking for replies to be sent to the MAC address. This is because computers communicate only with MAC addresses on LANs (Local Area Networks)
If no response is received by PC-A, then ARP & IP assume that
192.168.2.25 is on a remote subnet and therefore would require routing. At this point the IP address and the MAC address of the default gateway is required. In a Windows machine the registry is consulted in order to get the IP address of the default gateway
(192.168.1.15). ARP then consults it’s cache to see if it has match to the IP address of the default gateway, if not then another ARP broadcast is sent.
“Who has 192.168.1.15? Please tell 000000000010”?
Because this is a broadcast ALL hosts on the
192.168.1.0/24 sub-net will receive this frame. The router interface E0 will read the frame and identify itself as the interface with the requested IP address. The router will then reply.
“I have 192.168.1.15. MAC address is 000000000015”
As the request asked for a reply direct to PC-A the frame sent from the router will be directed towards PC-A and not sent as a broadcast. The router will also cache the MAC address of PC-A, which it received via the broadcast sent by ARP to locate the MAC address of the router.
Once IP at PC-A as received the message from the router interface it will pass the packet created earlier and the MAC Destination address down to the Data Link Layer.
The Data Link Layer creates a frame containing the Destination MAC address, the Source MAC address, A FCS (Frame Check Sequence, used to verify the data has not been corrupted) and an Ether_Type field, in this example the field will be set to 0x8 to indicate IP. This Frame encapsulates the packet passed down from IP at the Network Layer. The MAC address of the router is also cached into the ARP cache on PC-A
Once the frame has been created it is passed down to the Physical Layer where the frame is placed onto the wire one bit at a time. Every host on subnet
192.168.1.0/24 will receive this frame, build it, and check the Destination MAC address, if it is not a match the frame is discarded. At the router interface, E0, the Destination MAC address is a match. The router then checks the Ether_Type field (0x8 = IP) pulls the packet from the frame, discards the frame and passes the packet up to IP at the Network Layer.
At the Network Layer the Destination IP address is checked to see if it is a match, in this example the Destination IP address is
192.168.2.25, however the IP address of the router interface which received the frame is
192.168.1.15, and is not a match. The router then consults it’s routing table for the destination IP network address
(192.168.2.0). If there is no match in the routing table the packet is discarded and a “Destination Network unavailable” message is returned to PC-A
If there is a match in the routing table then the router will switch the packet to the interface configured to send information to the destination IP Network Address, in this example E1.
Interface E1 now needs to know the MAC address of the machine with IP address
192.168.2.25. The first thing it does is check the ARP cache, no match in the cache, E1 then send out an ARP broadcast.
Note: *Because of the characters limit here i have to publish it in two parts please manage to read completely to get the thorough idea.*