Understand ARP Ping Traceroute

In this Packet Tracer activity we will explore the ARP, Ping and Tracert / Traceroute commands and how they can help you determine the path to a given device. This lab has been created using Cisco Packet Tracer and while all the commands can be used on most devices available today. For the purpose of this exercise it is recommended to use Packet Tracer as it has a very useful simulation mode that will allow you to examine the packets as they transvers the network.

When you are trying to communicate with another device in a network there are basically two ways to lookup how to get to the device, they are referred to as the routing table and the ARP table or as I like to refer to them as a route or a shout. This is because devices within your local network or subnet are contained in the ARP tables and are like a bunch of people in a room. If you need reach one of these people you just shout out has anybody seen Joe and if Joe is there he will reply this is a shout. If he is not there he may be in another building so the operator speaks up and says I can find him and looks him up in the routing table, this is a route.



Address Resolution Protocol (ARP) is a network layer protocol used to convert an IP address into a physical address, such as an Ethernet address. A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. The host on the network that has the IP address in the request then replies with its physical hardware address.




Ping may be run using various options (command line switches) depending on the implementation that enable special operational modes, such as to specify the packet size used as the probe, automatic repeated operation for sending a specified count of probes, and time stamping options.


Traceroute is a computer network diagnostic tool for displaying the route (path) and measuring transit delays of packets across an Internet Protocol (IP) network. Traceroute is available on most operating systems.

 Traceroute sends a sequence of Internet Control Message Protocol (ICMP) echo request packets addressed to a destination host. Determining the intermediate routers traversed involves adjusting the time-to-live (TTL) aka hop limit Internet Protocol parameter. Frequently starting with a value like 128 (Windows) or 64 (Linux), routers decrement this and discard a packet when the TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded.

 Traceroute works by increasing the TTL value of each successive set of packets sent. The first set of packets sent have a hop limit value of 1, expecting that they are not forwarded by the first router. The next set have a hop limit value of 2, so that the second router will send the error reply. This continues until the destination host receives the packets and returns an ICMP Echo Reply message.

 Traceroute uses the returned ICMP messages to produce a list of routers that the packets have traversed. The timestamp values returned for each router along the path are the delay (aka latency) values, typically measured in milliseconds for each packet.


  Basic Tools (162.4 KiB, 1,408 hits)

  Packet Tracer 5-3-3 By Cisco (48.3 MiB, 1,815 hits)
You do not have permission to download this file.


Leave a Reply

What is 9 + 15 ?
Please leave these two fields as-is: