Protocols (ARP, RARP, IP, ICMP)

Computer Network & Network Security System — Network Layer, NEC licence examination syllabus (Nepal Engineering Council).

Network Layer Protocols: ARP, RARP, IP, ICMP

Four small protocols doing four very different jobs, all at this one layer.

📬 IP — the addressing workhorse

Datagram formatVersion, header length, total length, TTL (time to live — prevents infinite loops), protocol, source/destination address, and more.

FragmentationIf a datagram is bigger than the next network's maximum frame size (MTU), it gets split into smaller fragments — reassembled only at the final destination, not at intermediate routers.

🔄 ARP and RARP

ARPIP address → MAC address (already covered in the Data Link chapter, but it genuinely straddles both layers).

RARPThe reverse — MAC address → IP address. Used historically by diskless workstations that knew their own hardware address but needed to ask the network "what's my IP?"

🩺 ICMP — the network's diagnostic tool

What it's forCarries error and diagnostic messages, not user data.

Real exampleThe "ping" command you've probably run yourself sends ICMP Echo Request messages and waits for Echo Reply — that's ICMP at work.

💡 One-liner: "What message type does 'ping' use?" → ICMP Echo Request / Echo Reply.

Why a machine needs two addresses

The obvious question about ARP is why it must exist at all: if a device already has an IP address, why does it also need a MAC address?

🏷️ Two addresses, two jobs

IP addressIdentifies where a device sits in the network topology. It changes when the device moves to a different network, and it is what routers use to decide direction.

MAC addressIdentifies the physical interface itself. Burned in at manufacture, never changes, and is meaningful only on the local link.

A router forwards by IP, but the actual delivery on each hop is a frame addressed to a specific interface on that wire. So every hop needs a MAC address, and ARP is the join between the two systems: given the IP of a machine on this link, what is its hardware address?

Sending to 192.168.1.50 on the local network: 1. Not in the ARP cache → broadcast: "who has 192.168.1.50? tell 192.168.1.10" 2. Every device on the link hears it; only the owner replies: "192.168.1.50 is at aa:bb:cc:dd:ee:ff" 3. The answer is cached, so the next packet needs no broadcast.

💡 Note the asymmetry: the request is broadcast because the sender does not yet know who to ask, while the reply is unicast because the responder knows exactly who asked. And ARP resolves only addresses on the SAME link — for a remote destination a host ARPs for its default gateway instead, which is why the destination MAC changes at every hop while the destination IP never does.

What ICMP is for, and what it is not

ICMP carries no user data. It exists so the network can report on itself, which IP alone cannot do — IP is a best-effort protocol with no way to say that delivery failed.

📢 The messages worth knowing

Echo request/replyWhat ping uses — the simplest test that a host is reachable.

Destination unreachableA router could not deliver, and says which part failed: network, host, or port.

Time exceededThe TTL reached zero. This is what makes traceroute possible.

Traceroute is a neat use of an error message: send a packet with TTL = 1, and the first router discards it and reports "time exceeded" — revealing itself. Send TTL = 2 to reveal the second, and so on. The route is discovered entirely from failures deliberately provoked.

💡 TTL is decremented by every router and the packet is discarded at zero, which is what stops a routing loop circulating forever. It counts hops, not time, despite the name — a detail examiners like, since "time to live" suggests seconds.

Syllabus points

IP: datagram format, fragmentation
ARP and RARP
ICMP: message types and use

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.