Computer Networking Cheatsheet
DHCP ARP and ICMP
Use this Computer Networking reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
ARP, mapping IP to MAC
Before a host can put a frame on the wire it needs the destination MAC. ARP asks the local link for it, and the answer is cached.
Host A (192.168.1.37) wants 192.168.1.50 1. ARP Request broadcast to ff:ff:ff:ff:ff:ff "who has 192.168.1.50? tell 192.168.1.37" 2. ARP Reply unicast back to A "192.168.1.50 is at 00:1b:44:11:3a:b7" 3. A caches the pair and sends the frame
Critical rule: ARP is link local only. For an off-subnet destination the host ARPs for its default gateway, not the far host, so the destination IP and the destination MAC belong to different machines.
ip neigh # the ARP and NDP cache ip neigh show dev eth0 ip neigh flush all ip neigh add 192.168.1.50 lladdr 00:1b:44:11:3a:b7 dev eth0 nud permanent arping -I eth0 192.168.1.50 # probe at layer 2, works without IP routing arp -a # legacy, macOS and BSD
| Neighbour state | Meaning |
|---|---|
REACHABLE | confirmed recently |
STALE | cached, unverified, will probe on next use |
DELAY / PROBE | verifying now |
FAILED | no answer, host is down or not on this link |
PERMANENT | static entry, never expires |
Gratuitous ARP is an unsolicited reply announcing "this IP is now at my
MAC", which is how failover VIPs move and also how ARP spoofing works. Two
REACHABLE entries claiming the same IP means a duplicate address or an
attacker.
Proxy ARP and duplicate address detection
- Proxy ARP lets a router answer for hosts on another segment, which glues
split subnets together. It hides real topology, so use it only deliberately
(sysctl net.ipv4.conf.eth0.proxy_arp=1).
- DAD sends an ARP probe for your own address at boot. A reply means a
conflict, and the interface refuses the address. The symptom is
intermittent connectivity for both machines as the switch flip-flops the MAC
table entry.
DHCP DORA
Four messages, all UDP, client port 68 to server port 67. The client starts with no address, so the first packets are broadcast.
| Step | Message | Direction | Source → destination | Carries |
|---|---|---|---|---|
| D | DISCOVER | client → broadcast | 0.0.0.0:68 → 255.255.255.255:67 | client MAC, requested options |
| O | OFFER | server → client | server IP:67 → broadcast or unicast :68 | proposed IP, mask, lease time |
| R | REQUEST | client → broadcast | 0.0.0.0:68 → 255.255.255.255:67 | accepts one offer, names the server |
| A | ACK | server → client | server IP:67 → :68 | lease confirmed, full option set |
REQUEST is broadcast even though the client has chosen a server, so the other servers on the segment learn their offers were declined.
| Other message | Purpose |
|---|---|
NAK | the requested address is not valid, restart DORA |
DECLINE | client found the address already in use (DAD failed) |
RELEASE | client gives the lease back early |
INFORM | client has a static IP, wants only options |
DHCP options, leases, and relays
| Option | Number | Value |
|---|---|---|
| Subnet mask | 1 | 255.255.255.0 |
| Router (default gateway) | 3 | 192.168.1.1 |
| DNS servers | 6 | list of resolvers |
| Domain name | 15 | corp.example.com |
| Broadcast address | 28 | 192.168.1.255 |
| NTP servers | 42 | time sources |
| Lease time | 51 | seconds |
| Message type | 53 | DISCOVER, OFFER, ... |
| Server identifier | 54 | which server owns the lease |
| Classless static route | 121 | extra routes, preferred over option 33 |
Renewal happens at T1 = 50% of the lease (unicast to the same server) and
T2 = 87.5% (broadcast to any server). Failing both, the client falls back to
link-local 169.254.x.x, which is the tell that DHCP is broken.
Because DISCOVER is a broadcast it does not cross a router. A DHCP relay (IP helper) forwards it as unicast to a central server and stamps option 82 so the server knows which subnet to serve.
dhclient -v eth0 # request or renew, verbose dhclient -r eth0 # release cat /var/lib/dhcp/dhclient.leases journalctl -u systemd-networkd -e nmcli -f ALL device show eth0 | grep -i dhcp
ICMP types you will actually see
ICMP is layer 3 signalling, not a transport. It has no ports, which is why firewall rules for it look different.
| Type | Code | Name | Emitted when |
|---|---|---|---|
| 0 | 0 | Echo Reply | answering a ping |
| 3 | 0 | Net unreachable | no route to the network |
| 3 | 1 | Host unreachable | route exists, host does not answer ARP |
| 3 | 3 | Port unreachable | no UDP listener, and how traceroute ends |
| 3 | 4 | Fragmentation needed, DF set | PMTUD, blocking it breaks large transfers |
| 3 | 13 | Communication administratively prohibited | a firewall rejected it |
| 5 | 0-3 | Redirect | "use a better gateway", often ignored as a spoofing risk |
| 8 | 0 | Echo Request | a ping |
| 11 | 0 | TTL exceeded in transit | every traceroute hop reply |
| 11 | 1 | Fragment reassembly time exceeded | lost fragments |
| 12 | 0 | Parameter problem | malformed header |
ICMPv6 (proto 58) additionally carries Neighbor Discovery and Router Advertisement, so you cannot block ICMPv6 wholesale or IPv6 stops working.
Diagnosing with ICMP
ping -c 4 192.168.1.1 ping -M do -s 1472 8.8.8.8 # PMTUD probe, DF set ping -I eth0 -c 3 10.0.0.1 # force the source interface traceroute 8.8.8.8 # UDP probes by default traceroute -I 8.8.8.8 # ICMP echo probes traceroute -T -p 443 example.com # TCP SYN probes, gets through more firewalls mtr -rwc 20 8.8.8.8 # continuous, per-hop loss report
Read results carefully. Mid-path hops showing loss while the final hop is clean is rate-limited ICMP generation on a router, not a broken path. Only loss at the destination counts.