Understanding IP Packets, ICMP, and ARP: Formats, Functions, and Attack Techniques

IP Packet Format

Network layer functions: define routing paths, logical IP addresses, select optimal routes, and connect different media types.

IP packets consist of a 20‑byte fixed header and an optional variable‑length part.

Version (4 bits): IP protocol version (IPv4 = 0100).

Header Length (4 bits): length of the IP header.

Type of Service / Priority (8 bits): used for QoS.

Total Length (16 bits): entire packet size (header + data).

Identification (16 bits): used for fragment reassembly.

Flags (3 bits) and Fragment Offset (13 bits): control fragmentation.

TTL (8 bits): prevents endless looping; decremented by each router.

Protocol (8 bits): indicates the encapsulated upper‑layer protocol (ICMP=1, TCP=6, UDP=17).

Header Checksum (16 bits): verifies header integrity.

Source IP (32 bits) and Destination IP (32 bits).

Options (variable): optional fields such as timestamps.

ICMP Protocol Overview

ICMP is an error‑detection and feedback mechanism carried inside IP packets, used to report errors and provide control information.

ICMP message types include error reports and query messages.

ICMP Encapsulation

Encapsulation steps:

ICMP header + ICMP data.

Network layer adds IP header: IP header + ICMP message.

Data link layer adds frame header/trailer:

Frame header (source MAC) + IP packet + Frame trailer (destination MAC)

.

Typical ping command syntax:

ping [-t] IP_ADDRESS|target_name

-t

: continuous ping. -a: display host name. -l: set packet size. -n: specify number of packets. -S: specify source IP (e.g., ping -S 192.168.1.25 192.168.1.168).

ARP Protocol Overview

What is ARP?

Address Resolution Protocol maps a known IP address to its MAC address using an ARP cache that stores <IP, MAC> pairs with a TTL.

Operation

Host checks its ARP cache for the target IP.

If missing, it broadcasts an ARP request containing its own IP and MAC.

All hosts receive the request; the one with the matching IP replies directly with its MAC address.

The requester stores the MAC in its cache and proceeds with communication.

Common ARP commands (Windows): arp -a to view cache, arp -d to delete cache entries.

ARP Attack Principles

Attackers send forged ARP replies with a bogus MAC address, causing other hosts to associate the victim’s IP with the attacker’s MAC, leading to traffic interception or denial of service.

Example scenario: PC1’s traffic to the internet is redirected through PC2, which masquerades as PC1’s MAC, allowing PC2 to monitor or block the traffic.

Summary

IP packet structure and key header fields.

ICMP purpose, types, and encapsulation process.

ARP function, cache mechanism, and resolution workflow.

ARP spoofing attack methodology and impact.