What actually happens on the wire the first time PC1 pings PC2?
I typed ping 10.0.0.2 from PC1 and it worked. But what really happened before the first reply came back — especially the very first time, with empty caches?
1 Answer
Two protocols run, not one. PC1 wants to send an ICMP echo to 10.0.0.2, but frames need a destination MAC, and PC1's ARP cache is empty. So first: an ARP request broadcasts "who has 10.0.0.2?" — every host in the broadcast domain receives it. PC2 replies unicast with its MAC. Only now can the ICMP echo request go out in a properly addressed frame; PC2 answers with an echo reply. That's why the first ping often shows a higher latency (or even times out on real gear) while later pings are instant — the ARP exchange happens once, then it's cached. In the NetForge lab, run this with the packet animation on and check the PC's ARP table before and after: you'll see the broadcast flood, then the unicast conversation.