Is the "ping" command a broadcast message?

Question

I am learning about how ARP works and I have some questions regarding the ping network utility.

ping is used to test connectivity and reachability between devices. PCs have their own ARP table where they store IP addresses that match with corresponding MAC addresses in the LAN, right?.

Question 1

I have one desktop computer and one laptop in my local network connected to a router. Here is my topology

I've decided to clean my laptop's ARP table using arp -d and tried pinging my desktop computer (192.168.1.10) to see how the ARP entries work. The entry was successfully added, however, the router's entry was added as well. Why did this happen? I've pinged my desktop computer only.

Question 2

Again, I've cleared my laptop's ARP table. I did not communicate with any of the devices in my network, yet the router's ARP entry was still added. Any idea why and how did this occur? The desktop computer's entry wasn't added this time, only the router one.

Answer 1

Ping sends an ICMP Echo Request to the destination and expects an ICMP Echo Reply. ICMP messages is sent encapsulated in a IP packet, to the address that you specified. A unicast address requires knowledge of the destination MAC address (or gateway MAC for remote destinations). ARP is the common method to determine that MAC address.

Note that since you're pinging a local destination, the router function isn't actually involved. You seem to use a consumer-grade router that includes a layer-2 switch (for the "LAN" ports) and that one is involved.

Your hosts may send all kinds of messages back and forth, to each other or towards the Internet. Unless you know exactly the entirety of what's going on in the operating system and with all processes, you can only guess why an address was ARPed. However, host configurations and implementations are explicitly off-topic here.