Cisco CCNA Preparation · lesson 9 of 36 · 25 min
How Core Protocols Work Together
ARP, ICMP, DNS, and DHCP are four foundational protocols that work together to make IP networking functional. Understanding how they interact — and how attackers exploit them — is essential for the CCNA exam and for real-world troubleshooting.
ARP — Address Resolution Protocol
ARP resolves IPv4 addresses to MAC addresses. When a device needs to send a packet to an IP address on the same subnet, it must know the destination’s MAC address to build the Ethernet frame.
ARP process: 1) Device checks its ARP cache. 2) If not found, broadcasts an ARP Request: “Who has IP 192.168.1.1? Tell 192.168.1.10.” 3) The device with that IP sends a unicast ARP Reply with its MAC address. 4) The requester caches the mapping.
Proxy ARP: A router responds to ARP requests on behalf of devices on other networks — used when hosts have incorrect subnet masks.
Gratuitous ARP: A device announces its own IP-to-MAC mapping without being asked — used after IP address changes and by some load balancers.
ARP resolution process
ARP spoofing
ARP has no authentication. An attacker can send fake ARP replies to poison the ARP cache of other devices, redirecting traffic through the attacker (man-in-the-middle). Dynamic ARP Inspection (DAI) on Cisco switches mitigates this.
ICMP — Internet Control Message Protocol
ICMP is used for network diagnostics and error reporting. It operates at Layer 3 and is encapsulated directly in IP packets (protocol number 1).
Traceroute
Traceroute works by sending packets with TTL=1, 2, 3… Each router decrements TTL; when it reaches 0, the router sends an ICMP Time Exceeded back to the source. This reveals each hop’s IP address and round-trip time.
DNS — Domain Name System
DNS translates human-readable domain names (www.cisco.com) to IP addresses. It uses UDP port 53 for queries (TCP port 53 for zone transfers and large responses).
DNS resolution process: 1) Client checks local cache. 2) Queries recursive resolver (usually ISP or 8.8.8.8). 3) Resolver queries root servers → TLD servers (.com) → authoritative nameserver. 4) Returns IP to client and caches result with TTL.
DHCP — Dynamic Host Configuration Protocol
DHCP automatically assigns IP addresses and network configuration to clients. It uses UDP: client sends from port 68, server responds from port 67.
DORA process: Discover (client broadcasts) → Offer (server offers IP) → Request (client requests offered IP) → Acknowledge (server confirms lease).
DHCP relay agent (ip helper-address): Routers do not forward broadcasts. A DHCP relay agent (configured with ip helper-address on the router interface) forwards DHCP broadcasts as unicast to the DHCP server on another subnet.
Knowledge Check — 10 Questions
ARP, ICMP, DNS, DHCP
What does ARP resolve?
- Domain names to IP addresses
- IPv4 addresses to MAC addresses
- IP addresses to port numbers
- MAC addresses to IPv6 addresses
Answer: IPv4 addresses to MAC addresses
ARP (Address Resolution Protocol) maps IPv4 addresses to MAC addresses so Ethernet frames can be addressed correctly on the local segment.
An ICMP Type 11 message indicates:
- Echo request
- Destination unreachable
- TTL expired in transit
- Redirect
- Answer: TTL expired in transit
ICMP Type 11 (Time Exceeded) is sent when a router decrements TTL to 0. Traceroute exploits this to map network paths.
What port does DNS use for standard queries?
- TCP 53
- UDP 53
- UDP 67
- TCP 443
Answer: UDP 53
DNS uses UDP port 53 for standard queries (fast, low overhead). TCP port 53 is used for zone transfers and responses larger than 512 bytes.
What is the correct order of the DHCP DORA process?
- Discover, Offer, Request, Acknowledge
- Discover, Request, Offer, Acknowledge
- Offer, Discover, Request, Acknowledge
- Request, Discover, Offer, Acknowledge
Answer: Discover, Offer, Request, Acknowledge
DORA: client broadcasts Discover → server sends Offer → client sends Request → server sends Acknowledge confirming the lease.
What Cisco IOS command enables a router interface to forward DHCP broadcasts to a remote DHCP server?
- ip dhcp pool
- ip helper-address
- ip dhcp relay
- ip broadcast-address
Answer: ip helper-address
ip helper-address [server-IP] on a router interface converts DHCP broadcast to unicast and forwards it to the specified DHCP server.
What DNS record type maps a hostname to an IPv6 address?
- A
- AAAA
- PTR
- MX
Answer: AAAA
AAAA records map hostnames to IPv6 addresses. A records map to IPv4. PTR is reverse DNS. MX is for mail routing.
What is a gratuitous ARP?
- An ARP request for a non-existent host
- A device announcing its own IP-to-MAC mapping without being asked
- An ARP reply to a broadcast
- A router responding to ARP on behalf of another device
Answer: A device announcing its own IP-to-MAC mapping without being asked
Gratuitous ARP is an unsolicited ARP reply. Used to update ARP caches after IP changes and by load balancers for failover.
ARP spoofing is mitigated on Cisco switches by:
- Port security
- Dynamic ARP Inspection (DAI)
- DHCP snooping only
- Spanning Tree Protocol
- Answer: Dynamic ARP Inspection (DAI)
DAI validates ARP packets against the DHCP snooping binding table, dropping ARP replies with MAC-IP mappings that do not match.
Traceroute works by sending packets with incrementing _____ values, causing each router to return an ICMP Time Exceeded message.
Answer: TTL
TTL (Time To Live) is decremented by each router. When it reaches 0, the router discards the packet and sends ICMP Type 11 back to the source, revealing its IP address.
Which DHCP message is sent as a broadcast by the client to find available DHCP servers?
- DHCP Offer
- DHCP Request
- DHCP Discover
- DHCP Acknowledge
Answer: DHCP Discover
The client has no IP address yet, so it broadcasts a DHCP Discover to find available servers. The server responds with a unicast DHCP Offer.
Previous lesson: Subnetting practice: VLSM, CIDR, calculating hosts and networks
Back to Cisco CCNA Preparation
Next lesson: VLANs: access ports, default VLAN, inter-VLAN routing, trunk ports, 802.1Q, native VLAN