<< Back to article

Main Protocols: ARP, ICMP, UDP, TCP

The internet relies on a suite of protocols that define how data is addressed, routed, and delivered. Understanding these core protocols is essential for network troubleshooting and security.

ARP (Address Resolution Protocol)

ARP maps IP addresses to MAC addresses on a local network. When a host wants to send a packet to an IP address on the same subnet, it uses ARP to discover the corresponding MAC address.

ARP Operation

  1. Host A checks its ARP cache for the MAC address of IP X.
  2. If not found, it broadcasts an ARP request: "Who has IP X? Tell IP Y."
  3. Host with IP X responds with its MAC address.
  4. Host A caches the mapping and sends the frame.

View and manipulate the ARP cache:

ip neigh show                    # View ARP cache
arp -a                           # Legacy ARP command
ip neigh add 192.168.1.1 lladdr aa:bb:cc:dd:ee:ff dev eth0

Reverse ARP (RARP)

RARP is the inverse: a host discovers its IP address from its MAC address. It is largely obsolete, replaced by BOOTP and DHCP.

ICMP (Internet Control Message Protocol)

ICMP is a supporting protocol for IP, used for diagnostic and error reporting. It does not carry application data.

Key ICMP Types

  • Echo Request/Reply (ping): Test reachability of a host.
  • Destination Unreachable: Router cannot forward a packet.
  • Time Exceeded: Packet's TTL reached zero (used by traceroute).
  • Parameter Problem: Invalid header field.
  • Source Quench (deprecated): Congestion control.

Ping

ping -c 4 8.8.8.8
ping6 -c 4 2001:4860:4860::8888

Traceroute

Traceroute maps the path packets take to a destination:

traceroute example.com
tracepath example.com
mtr example.com

ICMP is often blocked by firewalls, which can affect ping and traceroute results.

UDP (User Datagram Protocol)

UDP is a connectionless transport protocol. It provides:

  • No connection setup: No handshake before sending.
  • Unreliable delivery: No retransmission, ordering, or deduplication.
  • Low overhead: 8-byte header, minimal processing.
  • Preserves message boundaries: Each send() corresponds to one recv().

UDP is used by:

  • DNS: Queries and responses are typically UDP.
  • DHCP: Address assignment.
  • VoIP and video streaming: Low latency is critical.
  • Gaming: Real-time state updates.
  • QUIC: HTTP/3 runs over UDP for improved performance.

TCP (Transmission Control Protocol)

TCP is a connection-oriented, reliable transport protocol. It guarantees ordered, error-checked delivery.

TCP Handshake

  1. SYN: Client sends SYN packet to initiate connection.
  2. SYN-ACK: Server acknowledges and sends its own SYN.
  3. ACK: Client acknowledges the server's SYN.

TCP Features

  • Reliability: Retransmits lost packets, reorders out-of-order packets.
  • Flow control: Prevents sender from overwhelming receiver (sliding window).
  • Congestion control: Adjusts sending rate based on network congestion (slow start, congestion avoidance).
  • Full-duplex: Simultaneous bidirectional communication.

TCP Connection States

ss -tnp                         # Show TCP connections
cat /proc/net/tcp               # Raw TCP table

Common TCP Flags

  • SYN: Synchronise sequence numbers (start connection).
  • ACK: Acknowledgment.
  • FIN: Finish (graceful close).
  • RST: Reset (abrupt close).
  • PSH: Push (send data immediately).
  • URG: Urgent pointer.