TCP/IP basics for Linux Network Programming (2): Explains ping commands using ARP and ICMP protocols

I. MTU

Both Ethernet and IEEE 802.3 have limits on the length of data frames. The maximum values are 1500 and 1492 bytes respectively. These limits are called the maximum transmission unit (MTU, maximum transmission unit)
If there is a datagram to be transmitted on the IP layer and the data length is greater than the MTU on the link layer, fragmentation is required on the IP layer to split the datagram into several slices, in this way, each piece is smaller than MTU.
When two hosts on the network communicate with each other, the two hosts need to go through multiple networks, and the link layer of each network may have different MTU, the minimum MTU in the two communication host paths is called the path MTU, and the standard MTU on the internet is 576b.

Ii. Ethernet frame format

The source address and destination address are the hardware address (also called the MAC address) of the network card. The length is 48 bits and is fixed at the factory of the network card. Run the ifconfig command to check that the "hwaddr 00: 15: F2: 14: 9e: 3f" part is the hardware address. The protocol field has three values, corresponding to IP, ARP, and RARP respectively. The end of the frame is a CRC check code.
The Data Length in an Ethernet frame is defined as a minimum of 46 bytes, a maximum of 1500 bytes, and a minimum of 46 bytes for ARP and RARP packets. Fill in the following bits. The output of the ifconfig command also contains "MTU: 1500 ". Note that the MTU concept refers to the maximum length of the payload in a data frame, excluding the length of the frame header.

Iii. ARP (Address Resolution Protocol)

During network communication, the application of the source host knows the IP address and port number of the target host, but does not know the hardware address of the target host, the packet is first received by the NIC and then processed by the upper-layer protocol. If the hardware address of the received packet is inconsistent with that of the local machine, it is discarded directly. Therefore, you must obtain the hardware address of the target host before communication. ARP plays this role. The source host sends an ARP request, asks "what is the hardware address of the host whose IP address is 10.0.0.1", and broadcasts the request to the _______ network segment (enter FF: FF for the hardware address of the Ethernet frame header: FF: FF indicates broadcast.) When the target host receives the broadcast ARP request and finds that the IP address matches the local host, it sends an ARP response packet to the source host, enter your hardware address in the response package. As shown in

Each host maintains an ARP cache table, which can be viewed using the ARP-a command. The table items in the cache table have an expiration time (generally 20 minutes). If a table item is not used again within 20 minutes, the table item is invalid, next time, send an ARP request to obtain the hardware address of the target host.

Note that the source MAC address and target MAC address appear each time in the Ethernet header and ARP request. It is unnecessary for the link layer to be Ethernet, however, if the link layer is another type of network, it may be necessary. The hardware type refers to the link layer network type. 1 is Ethernet, the protocol type refers to the address type to be converted, and 0x0800 is the IP address, the length of the following two addresses is 6 and 4 (bytes) for the ethernet address and IP address respectively. The op field is 1, indicating the ARP request, and the OP field is 2, indicating the ARP response.

The process of the Address Resolution Protocol is as follows:

Iv. RARP (Reverse Address Resolution Protocol)

The opposite of ARP is mainly used to obtain the IP address of a diskless workstation, as shown in.

5. ICMP (Internet Control Message Protocol)

The ICMP protocol is used to transmit control data such as error information, time, ECHO, and network information, as shown in.

ICMP packets are transmitted in IP datagram, as shown in.

For specific types and codes, see.

6. Explain the Ping program using ARP and ICMP protocols

Let's take a look at the following flowchart and explain it again.

Step A: ping the application to determine whether the host name or IP address is sent. If the host name is sent, the gethostbyname () function is called to Resolve Host B and convert the host name to a 32-bit IP address. This process is called DNS domain name resolution.
Step B: The Ping program sends an ICMP ECHO packet to the destination IP address
Step C: Convert the IP address of the target host to a 48-bit hardware address, send an ARP request broadcast in the LAN, and find the hardware address of host B.
Step D: After the ARP protocol layer of host B receives the ARP request from host a, it fills in the hardware address of the local machine in the response packet and sends the ARP response to host.
Step E: Send an ICMP packet to host B.
Step F: Host B receives the ICMP packet from host a and sends a response packet.
Step G: host a receives the ICMP packet response packet from host B.

Refer:

Linux C Programming one-stop learning

Chapter 1 TCP/IP details