Here am going to share snapshot of how ping works,
we all know that ping is the utility program to test connectivity between hosts.
I am taking two categories ,
1. Ping host which is in same subnet
2. ping host which is in different network
case -1 :
- when ping host (which is in same subnet ), first ARP broadcast happens , then icmp request/reply processed
- broadcast mac ff:ff:ff:ff:ff:ff , destination ip address ARP broadcast will be zero as its unknown
case -2 :
- icmp request sent to gateway as the destination address , as ping host is in different network so none of the present route matches
- the ping can flow in any of the interfaces on the local host, depends on the destination ip subnet
- ping request/reply processed between localhost to gateway - remote host
ARP cache can have its neighbor entries along with its gateway.