How Does Ping Work? A Step-by-Step Walkthrough of ICMP and ARP

Preface

Ping is a common method for diagnosing device accessibility failures. It uses the Internet Control Message Protocol (ICMP) to determine:

Whether the remote device is reachable.

Whether packets are lost when accessing the remote device.

The round‑trip latency between the local and remote devices.

Ping Principle

Now an example illustrates the Ping implementation process.

As shown, PC1 wants to ping PC2, i.e., Ping 11.1.1.2.

PC1's Ping program generates an ICMP request packet.

If PC1 cannot find the next hop, it lacks the next hop IP and MAC address, so the Ethernet frame cannot be encapsulated and the ping fails.

If PC1 finds the next hop IP but not its MAC address, PC1 sends an ARP broadcast request.

The ICMP packet is passed down to the IP layer, where an IP header containing source and destination IP addresses is added. During this, the IP layer determines that the source and destination IPs are in different subnets.

The ICMP packet continues down to the link layer to be encapsulated in an Ethernet frame, but the destination MAC is unknown, so encapsulation is pending.

Because the IPs are in different subnets, PC1 looks up its FIB table to find its next hop.

The next hop (Switch port a 10.1.1.2/24) receives the request, recognizes the IP as its own, and replies with a unicast ARP response containing its MAC address.

PC1 receives the ARP response, obtains the next hop MAC, encapsulates the Ethernet frame, and sends the packet to the Switch. PC1 also writes its IP‑to‑MAC mapping into the ARP request, which the Switch stores in its ARP cache for future communication.

Switch receives the packet, strips the Ethernet header, passes it to the IP layer, sees that the destination IP 11.1.1.2/24 is not its own, looks up its routing table, and forwards the packet after performing another ARP broadcast to resolve the destination MAC.

PC2 receives the request, sees the IP as its own, and replies with a unicast ARP response containing its MAC address, also recording the Switch’s IP‑to‑MAC mapping in its ARP cache.

Switch now has PC2’s MAC address, encapsulates the Ethernet frame, and forwards the packet to PC2.

PC2 strips the Ethernet and IP headers, identifies the ICMP echo request, and sends an ICMP echo reply to PC1. The source IP becomes 11.1.1.2/24 and the destination IP becomes 10.1.1.1/24. Because the IPs are in different subnets, PC2 looks up its FIB, finds the next hop Switch port b 11.1.1.1/24, and uses its ARP cache (already containing the Switch’s MAC) to encapsulate and send the reply.

Switch forwards the reply to PC1 using its ARP cache without sending a new ARP request.

PC1 receives the reply, strips the layers, obtains the ICMP echo reply, and confirms that the ping is successful.