what's the reason for the ARP is running while trying the ping command?

Question

when i try ping command and when i see it in wireshark first ARP request is going and after the ARP reply only ICMP request is going ,

i think this is what the reason for the ARP request going in the first,,

while trying ping it need to know the MAC address of the target device, so its trying to the get the MAC address first and then its sending ICMP request

if that is true is it possible to mention the mac address in the ping command(not to try for ARP)

if that is not true what's the reason

Answer 1

You'll note that the ARP request only happens the first time you run ping. If you run it a second time (shortly after the first run), you'll see that the ping start immediately with an ICMP request. This is because when a system discovers the IP address/MAC address association via ARP, it stores the result in a local arp cache. Entries in the cache do expire after some amount of time.

You can manually populate the ARP cache using the arp command:

arp -s <ipaddr> <macaddr>

E.g.:

arp -s 192.168.1.1 192.168.1.1

You can see the contents of your ARP cache like this:

arp -an

So if you were to manually update the ARP cache with the MAC address of your target host, you would be able to ping it with an ARP request going over the network.