,

Contents · ARP, ICMP, DHCP, DNS

ARP/ND: Address resolution

L2↔L3 mapping | 8-minute read
  • ARP (IPv4): map IP→MAC via broadcast who-has; caches with timeouts, gratuitous ARP.
  • ND (IPv6): neighbor discovery via ICMPv6 multicast; combines ARP+ICMPv6 functions.
  • Proxy ARP/ND and ARP inspection; stale entries cause one-way traffic or delay.
ARP: who-has 192.0.2.10? tell 192.0.2.1 → 192.0.2.10 is at 00:11:22:33:44:55

ICMP: Control and diagnostics

Control plane | 7-minute read
  • Echo request/reply (ping), TTL exceeded (traceroute), destination unreachable.
  • Path MTU discovery uses ICMP fragmentation-needed messages.
  • ICMPv6 adds ND, router advertisements; filtering ICMP can break PMTUD.
PMTUD: host lowers MSS on ICMP "fragmentation needed"

DHCPv4/DHCPv6: Address assignment

Provisioning | 9-minute read
  • DHCPv4 DORA: Discover, Offer, Request, Acknowledge; options (router, DNS, lease).
  • DHCPv6: SOLICIT, ADVERTISE, REQUEST, REPLY; IA_NA vs SLAAC, PD for prefixes.
  • Relays (giaddr/option 82), reservations, and conflict detection.
Client 0.0.0.0:68 → 255.255.255.255:67 (Discover) ...

DNS: Naming and resolution

Hierarchy | 10-minute read
  • Hierarchical zones: root, TLD, authoritative servers; recursive resolvers and caches.
  • RR types: A/AAAA, CNAME, NS, MX, TXT, SRV; negative caching (SOA).
  • DNSSEC: signed zones, validation chain; EDNS(0), DoT/DoH for privacy.
Query www.example → resolver → root → .com → example.com NS → A/AAAA

Security considerations

Threats | 7-minute read
  • ARP spoofing/poisoning; DHCP rogue servers; DNS cache poisoning; ICMP abuse.
  • Mitigations: DAI/port security; DHCP snooping; DNSSEC; ICMP rate limits, ACLs.
  • Prefer least-privilege control-plane policies; monitor anomalies.

Operational troubleshooting

Practice | 7-minute read
  • Check ARP/ND tables; flush stale entries; verify DHCP leases and logs.
  • Use dig/nslookup for DNS; verify recursion, TTLs, and authoritative answers.
  • Packet captures reveal mis-tagging, misconfigurations, or blocked ICMP.

Exercises

Hands-on | 9-minute read
  1. Simulate a DHCPv4 DORA exchange and label each message and option.
  2. Use traceroute and explain each ICMP response seen along the path.
  3. Deploy a local caching resolver and measure cache hit ratios over time.
Control-plane protocols are the nervous system of networks—secure and observe them carefully.

© | Visit us online at