7

What happens with a ping when it enters a network? Does the router redirects it to one of the devices on the network, or it sends the reply itself?

Device a1 from network A, with public IP adress P1 sends a ping to a public IP on network B, with IP P2. The ping arrives in the B network throug the router R. Is the router R the one responding to the ping, or it redirects the ping to one of the devices on the B network, e.g. b1?

EDIT: to explain my bewilderment. A ping request has a destination, for ex. a public IP. But in many cases, that public IP belongs to a whole network. For example a personal network. Which device from that network deals with the ping response?

  • 3
    Your edit means that you really do not understand how NAT works by building a table to determine which host in the network is getting the reply. If there is no table entry, then the NAT device itself is the target because it is the device addressed with that address. – Ron Maupin Jan 21 at 19:17
  • 2
    Two decades ago, “ip directed broadcast” was a thing. You could ping 172.21.255.255 and routers would replicate the ping and every host in the class-B would respond. This was useful for (for example) directed broadcast NTP updates. The feature was abused to magnify DDOS attacks and “no ip directed broadcast” has been default on Cisco routers (and presumably other platforms) for two decades now. I’ll bet it’s not even supported any more (and good thing!). – Darrell Root Jan 22 at 17:27
  • 1
    The router replies only if you ping it ;-). – Peter - Reinstate Monica Jan 23 at 11:18
11

What happens with a ping when it enters a network? Does the router redirects it to one of the devices on the network, or it sends the reply itself?

A router routes packets towards the destination. An IP packet with ICMP payload (ICMP ping request) is treated no differently than any other packet.

With "enter a network" you might be referring to routing a packet from public IP space (the Internet) to a private IPv4 address. Since private addresses are meaningless in public space by definition, this isn't even possible. Packets with private destination addresses are usually dropped by Internet routers and cannot by used.

However, since connecting private IP space with public IP space usually involves NAT, you need to understand how that works. Connecting into a private LAN requires port forwarding aka reverse NAT aka destination NAT. Connecting out of a private LAN requires source NAT - the private IP address is replaced by a usable public IP from the router's pool.

So, if your server www.domain.tld is located inside your LAN and the HTTP/S ports are forwarded by the router, this forwarding works only for the defined protocols - TCP with port 80 or 443 in that case. Since www.domain.tld resolves to the public IP address of your router, pinging by name actually pings the router's public address.

Similar to port forwarding, some routers do allow forwarding ICMP to an internal host but that is normally only used for static NAT/exposed host setups where you have a dedicated public IP for a host and forward everything.

But in many cases, that public IP belongs to a whole network.

As explained above and by the other answers, you are confusing NAT routing with normal routing. Only when a (private) network is hidden behind a single public IP, that address is the only one you see from the outside. It's also very common to use a pool of public IP addresses which may be used purely randomly or by some correlations.

"Routing" does not imply NAT. Effectively, NAT is rarely used - only by the edge routers connecting public and private IP spaces, which does make it prominent. All other routers - on the Internet or within private LANs - don't require NAT and typically don't use it.

NAT is designed as a kludge to enable private IPv4 networks to use their own, not IANA-managed addressing in order to avoid the early exhaustion of public IPv4 addresses. With IPv6, this kludge doesn't even exist to this extent (NAT64 is a proposed standard only).

For example a personal network. Which device from that network deals with the ping response?

While home networks are off-topic here, these use a public IP address that the NAT router translates to (or from). So, you can only ever ping that router from the outside.

Note that all these translations are only required by and used with IPv4. IPv6 doesn't require any translation, so it's more logical and follows the proper end-to-end paradigm of TCP/IP.

|improve this answer|||||
  • Thank you for the long post, now it really makes sense for me! That's the answer I was waiting for – Alexandru-Mihai Manolescu Jan 22 at 11:28
  • 1
    Note : in Europe, NAT is used for just about every business network. RIPE gave me a hard time when I requested a block of 16 adresses for a 10000-user network ! – grahamj42 Jan 22 at 20:31
  • It is entirely possible to set up a DNAT rule to redirect ICMP packets to a machine on the private network. This is similar to how "port forwarding" works. Why on earth you would want to do this on the other hand... – Aron Jan 23 at 2:06
  • tl;dr .. though you wrote that the ICMP packet isnt handled any different than other traffic - I should mention that almost EVERY NAT-router offers a setting or even by default - doesnt handle ICMP .. at best the router himself answers on his external WAN-interface - but even that is mostly off by default. – eagle275 Jan 23 at 11:00
  • @eagle275 On-topic, business-grade routers often support ICMP forwarding. Consumer-grade, off-topic ones very rarely do. – Zac67 Jan 23 at 11:10
6

It's the host which is addressed in the outgoing ECHO REQUEST packet which is responsible for answering. As far as the routers in between are concerned, this is just like any other IP packet, and their job is just to get it to that host.

Everything you need to know is in RFC 792 "Internet Control Message Protocol".

|improve this answer|||||
5

Ping is an application that sends ICMP Echo Requests to a destination and look for the destination to reply with an ICMP Echo Reply.

ICMP is the payload of, although an integral part of, IP. That means that the ICMP Echo Request is encapsulated in an IP packet, and the IP packet has the destination IP address in the IP packet header. IP packets are sent to the device with the destination IP address. If the destination device is running, and it has not otherwise restricted ICMP Echo Replies, the device will reply to the ICMP Echo Request with an ICMP Echo Reply.

|improve this answer|||||
4

But in many cases, that public IP belongs to a whole network. For example a personal network.

That is not correct. You are probably talking about Network address Translation (NAT), which is used on nearly all personal networks (and most commercial ones too). The IP address belongs to the NAT device (router or firewall).

Networks do not have IP addresses.

|improve this answer|||||
  • 1
    I think that's a mater of semantics. I could say that my entire home network has one public IP, so "my network has an ip". – JPhi1618 Jan 22 at 20:45
  • 1
    No, your NAT device (router) has the IP address. You could say "all my devices are NATted to one IP address," but saying your network has one IP is just inaccurate. – Ron Trunk Jan 22 at 20:56
4

HostA(10.10.10.100/24) -----.1/24 RTRA-56.0.0.1------WAN(INTERNET)-------12.0.0.100-RTRB

Default gateway of HostA is inside interface of RTR-A Here is the ping packet flow, read slow and carefully, it might get confusing

ping 12.0.0.100 from HOST-A at packet level

  1. sourceip will be hostA, src mac will be hosta dest ip will be 12.0.0.100 and mac will be inside interface of RTRA ( considering RTR A is the default gateway of hostA and arp lookup has already been resolved for Default gateway ).

  2. RTR A now will modify the mac addresses in packet keeping the ip address same because you need only mac info to forward packets between directly connected network at each hop. At this point, Source mac will be exit interface of RTRA and destination mac address will be the next hop of RTRA on WAN ...

  3. Above process of swapping the mac addresses will keep on happening until the ICMP packet that you sent from your host reaches the actual destination network.

  4. Since the destination ip address that you pinged actually belonged to RTR B, it will reply to that packet itself and will not forward it to any host connected further downstream to it.

Regarding you edit EDIT: to explain my bewilderment. A ping request has a destination, for ex. a public IP. But in many cases, that public IP belongs to a whole network. For example a personal network. Which device from that network deals with the ping response?

I would suggest if you take a look at how NAT works and you will find the answer to your own question as correctly observed by @Ron Maupin

See these two links for ip packet walks https://www.geeksforgeeks.org/packet-flow-in-different-network/ https://www.geeksforgeeks.org/packet-flow-in-the-same-network/ Use google for basics of NAT or youtube a video lecture.

|improve this answer|||||
  • Thank you, Gurpreet! It makes sense now for me. – Alexandru-Mihai Manolescu Jan 22 at 9:33
  • "RTR A now will modify the mac addresses in packet" It is a myth that routers modify MAC addresses, which are on the frame, not the packet. Routers strip off the frame,losing any layer-2 information, including MAC addresses if the protocol uses that. Not all layer-2 protocols use MAC addresses. For example, many home network WAN connections use PPPoA, which has no MAC addressing, so the router will create a new frame for the next interface, and it may not even have MAC addressing. Simply say the router strips the original frame and builds a new frame for the packet. – Ron Maupin Jan 22 at 10:32
  • Yes, you are correct. That what i had in my head but probably the difference between a native speaker of language. – Gurpreet Kochar Jan 22 at 13:48
1

In my case, the only thing you can ping in my network from the outside is the gw (which does port address translation) if it is IPv4.

IPv6 ? When you can ping anything directly because in that case the route is thru a ipv6 tunnel.

If the address you send the ping to is a connection on a router, that route will answer (maybe.)

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.