IP support protocols and NAT
What this lesson connects
IPv4 forwarding needs local link delivery, initial host configuration, error reporting and sometimes address translation. ARP, DHCP, ICMP and NAT solve different parts of that problem. They are not interchangeable, and none makes the network universally reliable. Assume Ethernet with IPv4, ordinary unicast forwarding and empty caches when stated.
1. ARP resolves the next hop on the local link
A host first uses its IP routing decision to choose the next-hop IPv4 address. If the destination is on-link, that address is the destination itself. Otherwise it is the appropriate router interface. ARP maps this local-link protocol address to a link-layer address. An ARP request asks which station owns a target IPv4 address and normally uses Ethernet broadcast. The owner normally replies directly to the requester with its MAC address. Cached mappings avoid resolving every packet and expire or change over time.
Worked example: host192.0.2.10/24, gateway192.0.2.1, destination203.0.113.8. The host ARPs for192.0.2.1, not203.0.113.8. Its first frame has source MAC=host and destination MAC=gateway; the IP source and destination remain192.0.2.10 and203.0.113.8 absent NAT. At the next routed Ethernet hop, a new frame uses that router's outgoing MAC and its next hop's MAC. Ordinary IP routing does not preserve one end-to-end Ethernet header.
ARP requests do not cross routers as ordinary broadcasts. ARP cache and bridge MAC table are also different: one maps IP→MAC, the other MAC→port. ARP is carried directly in Ethernet, not as a UDP message. Classical ARP has no built-in authentication, so accepting forged mappings is a security risk; ARP itself neither encrypts traffic nor proves identity.
2. DHCP supplies configuration through leases
DHCPv4 commonly provides an address, subnet mask, router and DNS-server configuration under a lease. A client without configuration can start with source IP0.0.0.0 and use broadcast; UDP server port67 and client port68 allow delivery before ordinary unicast configuration exists. The usual initial sequence is DISCOVER, OFFER, REQUEST, ACK. The REQUEST selects an offered configuration; an OFFER alone is not final acceptance. A server may reject an unsuitable request with NAK.
One server can serve other subnets through a DHCP relay. Routers need not blindly forward the original LAN broadcast: the relay forwards the request with information identifying the client subnet. Broadcast/unicast choices depend on the client state, flags and relay use. Do not claim that every DHCP message always uses broadcast.
A lease is temporary. In the standard default timing model, renewal begins at T1=0.5×lease and, if renewal has not succeeded by then, rebinding at T2=0.875×lease unless the server specifies otherwise. For an8-hour lease these are4 hours and7 hours. Renewal normally contacts the granting server; rebinding seeks any available server. If the lease expires without renewal, the client must stop using the leased address. Renewal uses REQUEST/ACK behavior rather than requiring a fresh four-message discovery sequence every time. A reservation is a server policy, not a different transport protocol.
3. ICMP reports network conditions
ICMP is carried inside IP and supports control/error messages such as destination unreachable, time exceeded and echo request/reply. It has no TCP/UDP ports. Ping commonly uses echo request/reply; a reply suggests reachability and a round-trip measurement at that moment, not that every application port is working. Filtering, rate limits and loss can suppress responses, so no reply is not a complete diagnosis.
Traceroute sends probes with increasing TTL. A router where TTL expires usually returns time exceeded. The sender observes reporting hops and round-trip times, not separate one-way link delays. Classic UDP probes eventually elicit destination-unreachable/port-unreachable at the endpoint; ICMP-echo and TCP variants differ. Asterisks do not necessarily mean forwarding stopped, and different probes may take different paths.
ICMP error messages include enough of the triggering packet to associate the error with the affected communication. Errors are not generated for every possible dropped packet: important suppression rules include not responding with an ICMP error to another ICMP error and, ordinarily, not reporting errors for noninitial fragments or broadcast/multicast-triggered traffic. These constraints avoid error cascades. An ICMP error reports a condition; it does not retransmit the lost application data.
4. NAT and port translation
Basic NAT translates an address between address realms. Network Address Port Translation (NAPT, often called PAT) also translates transport ports, allowing multiple private hosts to share a public IPv4 address. A state table links outgoing and returning flows. Matching rules and mapping/filtering behavior vary by implementation, so do not infer one universal NAT algorithm from the term NAT.
Example TCP mappings:10.0.0.2:50000→198.51.100.9:40001 and10.0.0.3:50000→198.51.100.9:40002, both toward203.0.113.20:443. On the public side the two source endpoints differ by port. A reply for198.51.100.9:40002 maps back to10.0.0.3:50000. Relevant IP and transport checksum fields must be adjusted because addresses/ports change; TCP/UDP pseudo-header checksums include IP addresses. A timeout may remove inactive mappings. This table is distinct from the routing table and ARP cache.
Unsolicited inbound traffic generally needs a suitable existing mapping or configured forwarding under the translator's policy. NAT complicates inbound connections and protocols carrying addresses inside payloads. It does not itself provide encryption, user authentication or a full security policy. A firewall may coexist with it, but address translation and filtering are different functions. Private address ranges such as10/8,172.16/12 and192.168/16 can be reused in separate networks and are not ordinary globally routed public addresses.
5. End-to-end trace and pitfalls
A newly attached client obtains configuration with DHCP. It asks DNS for a server address using its configured resolver. To reach a remote resolver or server, it first resolves its local gateway through ARP as needed. It then sends IP packets inside local Ethernet frames; a NAT gateway may translate outgoing addresses/ports and reverse that translation for replies. Along the path, ICMP can report selected errors. ARP cannot replace DNS: host names→IP and local IPv4→MAC are different mappings. DHCP's DNS option identifies a resolver; it does not download every domain's address.
When solving traces, annotate four distinct objects: application destination, IP next hop, Ethernet destination and any translated transport endpoint. Keep the lease timer separate from ARP-cache expiry and NAT timeout. For diagnostics, distinguish observation from proof: missing ICMP, a valid DHCP lease or an ARP reply alone does not establish successful end-to-end application service.
Original practice: six single-correct MCQs
These original teaching questions are not previous-year questions. Choose exactly one answer.
P01. For an off-subnet destination, an Ethernet host normally ARPs for which address?
A. The remote server address B. The configured DNS name C. The selected local gateway IP D. The public NAT port
Answer: C
A: The remote server is not directly on this link.
B: ARP takes a protocol address, not a DNS name.
C: Routing selects the gateway; ARP resolves that next hop locally.
D: A port is not an ARP target address.
P02. Which initial DHCP sequence is conventional?
A. DISCOVER–OFFER–REQUEST–ACK B. OFFER–ACK–DISCOVER–REQUEST C. REQUEST–DISCOVER–ACK–OFFER D. ACK–REQUEST–OFFER–DISCOVER
Answer: A
A: The client discovers, receives offers, requests and gets acknowledgment.
B: This puts an acknowledgment before selection.
C: This is not the conventional initial four-message sequence.
D: Configuration is not initially acknowledged before discovery.
P03. With default timers and a 16-hour lease, if renewal has not succeeded, when does DHCP rebinding begin?
A. 4 hours B. 8 hours C. 14 hours D. 16 hours
Answer: C
A: This is one quarter, not T2.
B: 8 hours is default T1 renewal.
C: T2=0.875×16=14 hours.
D: 16 hours is expiry, not rebinding start.
P04. Which ICMP response commonly reveals an intermediate traceroute hop?
A. Echo request B. Time exceeded C. DHCP ACK D. ARP reply
Answer: B
A: The probe may be an echo request; the intermediate expiration report is different.
B: TTL expiration commonly produces time exceeded.
C: DHCP ACK is not ICMP.
D: ARP reply is link-local resolution, not ICMP.
P05. Two private TCP clients use the same source port to reach the same server through one public address. What can NAPT vary to distinguish their public source endpoints?
A. Only Ethernet frame length B. The server’s DNS name C. Translated source ports D. The IPv4 version
Answer: C
A: Length is not a flow endpoint identifier.
B: A DNS name is not the source transport endpoint.
C: Distinct translated ports distinguish these simultaneous public-side flows.
D: Changing IP version is not this translation mechanism.
P06. Which statement about NAT is correct?
A. It automatically encrypts every packet B. It replaces all routing and ARP state C. It guarantees application availability D. It translates addresses and may translate ports; security filtering is a distinct function
Answer: D
A: Address rewriting is not encryption.
B: Routing and local resolution remain necessary.
C: Translation does not guarantee end-to-end service.
D: Translation can coexist with filtering, but they are different functions.
Sources and scope
Aligned to the 2026 course. This lesson covers the stated slice, not the entire Computer Networks syllabus. All numerical examples and questions are original. No claim of 2027 completeness.
Sign in to keep your progress. Sign in