ICMP, ARP and DHCP (supporting)

Why it exists

IP alone cannot do three jobs that every network needs. When a packet cannot be delivered, someone must tell the sender: that is ICMP. On an Ethernet, a sender that knows only the destination's IP address must find the MAC address to put in the frame: that is ARP. And a host that has just been plugged in knows nothing, not even its own address: DHCP gives it an address, a mask, a gateway and a DNS server. GATE asks which protocol does which job, what a frame looks like at each hop (which addresses change), the sizes of these messages, and the lease timers of DHCP.

Prerequisites

You need the IPv4 address structure and subnets from IPv4 addressing, and the Ethernet frame (6-byte MAC addresses, the type field, the 46-byte minimum data, the CRC) from Ethernet.

Precise definitions

ICMP: reports and tests

The Internet Control Message Protocol reports errors in IP delivery and carries diagnostic messages. An ICMP message is carried inside an IP datagram (IP protocol number 1); it is not UDP or TCP and has no ports. Format: type (8 bits), code (8 bits), checksum (16 bits, the Internet checksum of the whole ICMP message), then type-dependent fields (for an echo: a 16-bit identifier and a 16-bit sequence number) and data. An error message carries the IP header and the first 8 bytes of the datagram that caused it, so the sender can tell which connection it concerns.

ping sends an echo request and measures the time until the echo reply. traceroute sends probes with TTL 1, 2, 3, ...: the router that makes the TTL 0 answers time exceeded from its own address, so the sender learns the path hop by hop; the destination ends the trace with port unreachable (UDP probes to an unused port) or an echo reply (ICMP probes). No ICMP error is sent about an ICMP error, about a broadcast, or about any fragment but the first.

ARP: from an IP address to a MAC address

A frame on a LAN needs the MAC address of the receiver. A sender that knows the next hop's IP address uses the Address Resolution Protocol:

1. It looks in its ARP cache (a table of IP address to MAC address entries that expire after a while).
2. If absent, it broadcasts an ARP request (Ethernet destination ff:ff:ff:ff:ff:ff, type 0x0806): "who has IP address X? tell me".
3. The owner of X answers with a unicast ARP reply carrying its MAC address; the asker caches it.

An ARP packet is 28 bytes: hardware type (2: 1 for Ethernet), protocol type (2: 0x0800 for IPv4), hardware address length (1: 6), protocol address length (1: 4), operation (2: 1 request, 2 reply), sender MAC (6), sender IP (4), target MAC (6), target IP (4). It is shorter than the 46-byte minimum of an Ethernet data field, so the frame is padded by 18 bytes: a minimum-size frame of 64 bytes with header and CRC.

ARP works only inside one subnet. If the destination is on another subnet, the sender resolves the MAC address of its default gateway and addresses the frame to that: so along a route the source and destination IP addresses stay the same, while the source and destination MAC addresses change at every router (each hop is a new frame between two neighbours). Variants: a gratuitous ARP announces one's own address (and detects duplicates); proxy ARP lets a router answer for hosts behind it; RARP (MAC to IP) is obsolete, replaced by BOOTP and DHCP.

DHCP: configuring a host

The Dynamic Host Configuration Protocol lets a host that has just joined obtain an IP address, a subnet mask, a default gateway and the address of a DNS server from a server, for a limited lease. It runs over UDP: the server uses port 67, the client port 68. Because the client has no address yet, its first messages are broadcasts with source address 0.0.0.0. The four messages ("DORA"):

1. DISCOVER: client to 255.255.255.255:67, "is there a server?";
2. OFFER: a server proposes an address (and lease, mask, gateway, DNS);
3. REQUEST: the client chooses one offer and asks for it (broadcast, so that the other servers see that theirs was refused);
4. ACK: the server confirms; the lease starts.

A server on another subnet is reached through a relay agent (usually the router), which forwards the broadcast as a unicast. The message is the old BOOTP format: 236 fixed bytes, a 4-byte magic cookie, and a list of options (the message type is option 53; 255 ends the list).

Lease timers. A lease of length $L$: at $T_1 = L/2$ the client tries to renew with the same server (unicast REQUEST); if that fails, at $T_2 = 7L/8$ it tries to rebind with any server (broadcast REQUEST); at $L$ the lease expires and the client must stop using the address and start over with DISCOVER. A server may refuse a request with a NAK.

How it works

A real ping. The script sent an ICMP echo request to 127.0.0.1 and read the reply; the table shows both messages byte by byte. The reply is the request with the type changed to 0 and the checksum recomputed.

traceroute. The TTL grows by one for each round of probes; each router that makes it zero answers with time exceeded.

An ARP request inside an Ethernet frame, field by field, with the padding.

A packet crossing a router. Host A (192.168.1.10) sends to B (10.0.0.5) through router R, all caches empty. Watch the MAC and IP columns: the IP addresses never change, the MAC addresses are different on each side of R, and the second packet needs no ARP.

DHCP. The four messages with their addresses, ports and sizes.

The lease timers.

Worked examples

#include <stdio.h>
#include <string.h>
 
int main(void) {
    unsigned char arp[28] = {0, 1,                         /* hardware type: Ethernet */
                             8, 0,                         /* protocol type: IPv4 */
                             6, 4,                         /* address lengths */
                             0, 1,                         /* operation: request */
                             0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 192, 168, 1, 10,   /* sender MAC and IP */
                             0, 0, 0, 0, 0, 0, 192, 168, 1, 1};                      /* target MAC (unknown) and IP */
    unsigned char frame[64];
    memset(frame, 0, sizeof frame);
    memset(frame, 0xFF, 6);                                /* destination: broadcast */
    memcpy(frame + 6, arp + 8, 6);                         /* source: the sender's MAC */
    frame[12] = 0x08;
    frame[13] = 0x06;                                      /* type: ARP */
    memcpy(frame + 14, arp, sizeof arp);
    int header = 14, data = (int)sizeof arp, pad = 46 - data, fcs = 4;
    printf("ARP packet: %d bytes\n", data);
    printf("Ethernet header %d + ARP %d + padding %d + CRC %d = %d bytes\n", header, data, pad, fcs, header + data + pad + fcs);
    for (int i = 0; i < 14 + 28; i++) printf("%02x%c", frame[i], (i % 14 == 13 || i == 41) ? '\n' : ' ');
    return 0;
}

ARP packet: 28 bytes
Ethernet header 14 + ARP 28 + padding 18 + CRC 4 = 64 bytes
ff ff ff ff ff ff 00 11 22 33 44 55 08 06
00 01 08 00 06 04 00 01 00 11 22 33 44 55
c0 a8 01 0a 00 00 00 00 00 00 c0 a8 01 01

#include <stdint.h>
#include <stdio.h>
 
static uint32_t sum_words(const uint8_t *p, int n) {
    uint32_t s = 0;
    for (int i = 0; i < n; i += 2) {
        s += (uint32_t)(p[i] << 8 | (i + 1 < n ? p[i + 1] : 0));
        s = (s & 0xFFFF) + (s >> 16);
    }
    return s;
}
 
int main(void) {
    uint8_t msg[16] = {8, 0, 0, 0, 0x12, 0x34, 0x00, 0x01, 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'};
    uint16_t c = (uint16_t)~sum_words(msg, 16);
    msg[2] = (uint8_t)(c >> 8);
    msg[3] = (uint8_t)c;
    printf("type 8 code 0 id 0x1234 seq 1: checksum 0x%04X\n", c);
    printf("receiver adds all 16 bytes: 0x%04X -> %s\n", (unsigned)sum_words(msg, 16), sum_words(msg, 16) == 0xFFFF ? "valid" : "corrupt");
    msg[0] = 0;                                              /* the reply: type 0, checksum recomputed */
    msg[2] = msg[3] = 0;
    c = (uint16_t)~sum_words(msg, 16);
    printf("the echo reply (type 0) has checksum 0x%04X\n", c);
    return 0;
}

type 8 code 0 id 0x1234 seq 1: checksum 0x5435
receiver adds all 16 bytes: 0xFFFF -> valid
the echo reply (type 0) has checksum 0x5C35

#include <stdio.h>
 
int main(void) {
    long leases[4] = {3600, 8 * 3600, 24 * 3600, 7 * 86400};
    for (int i = 0; i < 4; i++) {
        long L = leases[i];
        printf("lease %6ld s: T1 (renew) at %7.1f s, T2 (rebind) at %8.1f s\n", L, L / 2.0, L * 7 / 8.0);
    }
    int discover = 236 + 4 + 3 + (2 + 4) + 1;       /* fixed part, magic cookie, option 53, option 55 with 4 requested items, end */
    printf("a DISCOVER with the usual four requested options is %d bytes of DHCP data, %d bytes of IP packet\n", discover, discover + 8 + 20);
    return 0;
}

lease   3600 s: T1 (renew) at  1800.0 s, T2 (rebind) at   3150.0 s
lease  28800 s: T1 (renew) at 14400.0 s, T2 (rebind) at  25200.0 s
lease  86400 s: T1 (renew) at 43200.0 s, T2 (rebind) at  75600.0 s
lease 604800 s: T1 (renew) at 302400.0 s, T2 (rebind) at 529200.0 s
a DISCOVER with the usual four requested options is 250 bytes of DHCP data, 278 bytes of IP packet

Cheat box

Traps and GATE patterns

Connections

All three live beside IP: ICMP reports what went wrong with fragmentation (and the TTL), ARP fills in the Ethernet frames of Ethernet, and DHCP, a client of UDP, hands out the addresses and masks of the subnets. A switch forwards the ARP broadcast to every port, which is why broadcasts are what VLANs contain.

PYQs

Consider the following statements:
 (i) Address Resolution Protocol (ARP) provides
a mapping from an IP address to the
corresponding hardware (link-layer) address.
 (ii) A single TCP segment from a sender S to a
receiver R cannot carry both data from S to R
and acknowledgment for a segment from R to S.

Which ONE of the following is CORRECT?

Node X has a TCP connection open to node Y. The
packets from X to Y go through an intermediate IP
router R. Ethernet switch S is the first switch on the
network path between X and R. Consider a packet
sent
from
X
to
Y
over
this
connection.
Which of the following statements is/are TRUE about
the destination IP and MAC addresses on this packet
at the time it leaves X?

Consider the following two statements:
 S1: Destination MAC address of an ARP reply is
a broadcast address.
 S2: Destination MAC address of an ARP request
is a broadcast address.

Which one of the following choices is correct?

Suppose that in an IP-over-Ethernet network, a
machine X wishes to find the MAC address of
another machine Y in its subnet. Which one of the
following techniques can be used for this?

Which one of the following protocols is NOT used
to resolve one form of address to another one?

The address resolution protocol (ARP) is used for:

Which one of the following protocols may need to
broadcast some of its messages?

Self-check

Revision card

References