Function of network switch for IP traffic

Question

Suppose two computers and a router are connected to a layer 2 ethernet switch. Both computers are registered on the router's IP network. The user of computer 1 sends an ICMP ping request to computer 2 using computer 2's IP address. My understanding (which may not be correct) is that this communication will not pass through the router, only through the switch because computer 1 keeps an ARP table and is able to resolve computer 2's IP address to its MAC address before sending. My question is twofold:

1) What is the mechanism through which the source computer originally "learns" the MAC address of the destination computer and is therefore able to register this relationship in its ARP table?

2) Are these two computers technically still communicating over IP (layer 3)? Or are they technically implementing ICMP in layer 2? My confusion stems from the fact that ICMP is considered an "IP protocol".

Answer 1

To send a ICMP ping both L2 and L3 connectivity are required.

When computer 1 realises that the MAC address for computer 2 is not in its ARP table it will send an ARP request to computer 2. The ARP request will be sent to a destination of computer 2s IP address using a destination MAC address of FF:FF:FF:FF:FF:FF, this is the broadcast MAC address and means that the frame will be sent to all hosts in the L2 segment. However, only the host that matches the IP destination of the ARP request will respond, in this case computer 2, all other hosts will drop it. When computer 2 receives the ARP request it will use the source IP and MAC to send a unicast ARP response back to computer 1 containing its MAC address. On receiving the ARP response computer 1 will have both an IP address and a MAC address for computer 2 and will be able to communicate fully.

To answer your other question, ICMP is considered to operate at layer 3. Each layer in the OSI model is dependent on the layers below it.

Answer 2

The switch is Layer 2 only and only maintains a table containing mac-addresses and switch ports.

The PC's are Layer 3 devices and would use ARP to find the mac-address of the other L3 device they wanted to talk to. Once the IP to mac-address mapping is known, then the sending PC would create a packet with the IP of the remote PC in the destination field. This packet is then turned into a frame with the mac-address of the remote PC in the destination field and then sent onto the wire.

To directly answer question 1) The switch inspects all incoming frames to map the source mac-address to that interface. Then the switch inspects the destination mac-address field to determine where to send the frame, it is not interested in the IP (or IPv6) address in the frame's data field(where the IP packet is contained). If the destination mac-address of a packet is not known, then the switch floods the packet to all ports in the vlan it was received on.

And question 2) Yes, the PC's are communicating via IP. You don't need to know the mac-address of the remote PC as that is handled as part of the network stack.