ARP and ICMP Troubleshooting

How ARP works

Before an IPv4 host can send an Ethernet frame to an on-link destination or default gateway, it needs the destination's MAC address. It checks its ARP cache, broadcasts an ARP request when necessary, and records the reply.

Route lookup selects next hop

ARP cache checked

Broadcast ARP request

Unicast frame sent

ARP operates only within a Layer 2 broadcast domain. A router does not forward a normal ARP request between subnets. For a remote destination, the host resolves the MAC address of its local gateway, not the remote server.

ARP-related problems

Symptom	Possible ARP/Layer 2 cause
Can reach some local hosts but not gateway	Wrong VLAN, duplicate address, failed gateway SVI, port security or stale ARP.
ARP entry remains incomplete	No reply due to VLAN mismatch, host down, filtering, cabling or incorrect subnet.
Intermittent connectivity	Duplicate IP or unstable MAC movement.
Unexpected MAC for gateway	FHRP transition, proxy ARP, legitimate device replacement or spoofing.

Dynamic ARP Inspection can validate ARP messages against trusted information such as a DHCP snooping binding table. It must be deployed carefully because static devices, uplinks and trusted ports require correct handling.

ICMP message purpose

ICMP is carried within IP and communicates errors and operational information. Important IPv4 message types include echo request/reply, destination unreachable, time exceeded and redirect. Blocking all ICMP can hide useful failures and interfere with path MTU discovery.

Message	Typical meaning
Echo request/reply	Basic reachability and round-trip testing.
Destination unreachable	Network, host, protocol, port or policy-related failure depending on code.
Time exceeded	TTL reached zero; used by traceroute to reveal hops.
Fragmentation needed	Packet is too large for a path where fragmentation is not permitted; important for PMTUD.
Redirect	A router suggests a better local next hop; often restricted in hardened networks.

Ping and traceroute interpretation

A successful ping confirms more than one thing: DNS may have resolved the name, routing worked in both directions, ARP/ND worked on local segments, and ICMP was permitted. A failed ping does not prove the target is down because policy may block echo while the application remains reachable.

Traceroute manipulates TTL/hop-limit values and observes time-exceeded messages. Asterisks can mean filtering, rate limiting, asymmetric return paths or a device that does not answer probes—not necessarily a forwarding failure.

Common commands

# Windows
arp -a
ping 10.10.10.1
tracert 203.0.113.10
pathping 203.0.113.10

# Linux
ip neigh
ping -c 4 10.10.10.1
traceroute 203.0.113.10
tracepath 203.0.113.10

Layered troubleshooting workflow

Check link, interface state and VLAN membership.
Verify IP address, mask and default route.
Inspect ARP/neighbor state for the next hop.
Ping loopback, local address, gateway, remote IP and then remote name.
Compare forward and return routes.
Use traceroute while accounting for ICMP filtering and asymmetric paths.
Check MTU with controlled-size probes where supported.
Capture packets at both sides of a suspected boundary.
Review ACL, firewall, NAT and rate-limiting counters.

Common interview scenarios

Gateway ARP is incomplete: focus on local Layer 2/VLAN/interface state before remote routing.
IP works but hostname fails: investigate DNS rather than routing first.
Small packets work but large sessions stall: investigate MTU, PMTUD and ICMP fragmentation-needed handling.
Traceroute stops at a hop: test the destination application before assuming that hop is dropping transit traffic.
Duplicate IP: correlate ARP changes, switch MAC table, DHCP leases and endpoint logs.

Interview focus

Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.

Does ARP resolve a remote server's MAC address? No. For a remote subnet, the host resolves the local next-hop gateway's MAC address.
What does an incomplete ARP entry suggest? The request was sent but no usable reply was learned.
Which ICMP message helps traceroute reveal hops? Time Exceeded.
Does failed ping prove the server is down? No. ICMP may be blocked or rate-limited while the application works.
Why is ICMP important for path MTU discovery? It reports that a packet is too large for a path and fragmentation cannot be performed.

Quick self-check

1. Does ARP resolve a remote server's MAC address?

Answer: No. For a remote subnet, the host resolves the local next-hop gateway's MAC address.

2. What does an incomplete ARP entry suggest?

Answer: The request was sent but no usable reply was learned.

3. Which ICMP message helps traceroute reveal hops?

Answer: Time Exceeded.

4. Does failed ping prove the server is down?

Answer: No. ICMP may be blocked or rate-limited while the application works.

5. Why is ICMP important for path MTU discovery?

Answer: It reports that a packet is too large for a path and fragmentation cannot be performed.

Frequently asked questions

1. Can ARP cross a router?

Answer: Normal ARP broadcasts remain within the local Layer 2 domain.

2. Why does traceroute show asterisks but the website opens?

Answer: Intermediate devices may not answer probes even though they continue forwarding traffic.

3. Should all ICMP be blocked for security?

Answer: Usually no. A risk-based policy should allow necessary control messages while limiting abuse.

Standards and further reading

Editorial note: Standards explain protocol behaviour, while commands and defaults can differ by vendor, platform and software release. Verify production changes against current vendor documentation.