Hot answers tagged

47 votes

Why can I traceroute to this IP address, but not ping?

On a similar question here Luke Savage explained it perfectly: Traceroute is not a protocol itself, it is an application and the protocols used depends on the implementation your are using. Primarily ...
user avatar
  • 740
23 votes
Accepted

Interpreting TTL in ping results

So needless to say, nobody on the planet knows how many nodes there are between here and there. I know how many nodes. There are exactly 16. The reason you get different responses is because ...
user avatar
  • 62.5k
23 votes
Accepted

Where is Ping's "round-trip time" stored in the IP header?

The round trip time is not actually stored anywhere. The sending host remembers the time it sends each ICMP Echo Request message, using ICMP's 16-bit identifier and sequence fields. When it gets the ...
user avatar
  • 15.9k
20 votes
Accepted

Why do some common traceroute implementations default to using UDP probes?

The first version of traceroute was written by Van Jacobson and it used ICMP but it didn't work very well. The vendor interpretation of ICMP in RFC792 was that routers should not send an ICMP error ...
user avatar
  • 316
19 votes

Why can I traceroute to this IP address, but not ping?

To add to @naïveRSA's answer, if there's filtering/firewalling in the path one could also have the situation where an ICMP "echo reply" (ping) packet is blocked, but an ICMP "time exceeded" (tracert) ...
user avatar
  • 331
16 votes

PING port number?

I'd like to give you an additional answer especially to this part of the question: ... someone says ICMP uses Port 7 Port 7 (both TCP and UDP) is used for the "echo" service. If this service is ...
user avatar
14 votes
Accepted

Traceroute - every packet has TTL == 1

Let me try to answer this, because it's a little more complicated that it may look initially. It seems that you already know the basic operation of traceroute but before anything else here is a very ...
user avatar
  • 528
14 votes

Traceroute - every packet has TTL == 1

Your client is only sending the first three packets with a TTL of 1. The next three are sent with a TTL of 2. The next three are sent with a TTL of 3. And so on and so forth. An easier way to view ...
user avatar
  • 13.9k
14 votes
Accepted

What would happen to Ping if two PCs have same IP address with same Subnet Mask on same network?

Actually, the ping gets sent to a layer-2 address if they are on the same LAN. Assuming ethernet, the sending host may have a MAC address in its ARP cache, and the pings gets sent to the host with ...
user avatar
  • 93.6k
13 votes
Accepted

pinging broadcast address

Not all machines will answer a broadcast ping. (all broadcast -- 255.255.255.255, or subnet broadcast -- eg. x.x.x.255) Some see it as a "security feature", because one could spoof the origin to flood ...
user avatar
  • 29.6k
12 votes
Accepted

USE of ICMP echo request in DHCP

An ICMP Echo request from the DHCP server to the IP address its about to allocate is used to determine if the IP address about to be assigned is already in use on the network. If a response is ...
user avatar
  • 661
11 votes

Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page?

The original RFC for ICMP, RFC777 state that: ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by ...
user avatar
  • 18.4k
11 votes
Accepted

Why there are ip(ip) and domain(ip) 's difference and multi rows records in the traceroute?

1) Traceroute may attempt to resolve the hop's domain name via DNS. As you didn't include any additional flags to explicitly enable this functionality, your traceroute application does so by default. ...
user avatar
  • 963
10 votes
Accepted

dont fragment bit PING TOOL

Running "ping -M do -s 1490 example.com" says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding ...
user avatar
  • 143
9 votes
Accepted

IP Traceroute RFC 1393

The new ICMP message type as defined in this RFC actually was added to the ICMP standard - though it's currently listed as Historic in RFC 6918: 2.6. Traceroute (Type 30) This message type is ...
user avatar
  • 178
9 votes

What is first? ARP vs ICMP

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to ...
user avatar
  • 26.7k
9 votes
Accepted

Difference between ping timed out and destination host unreachable

First we need to understand how packets are sent. When a host or router tries to send an IPv4 packet* it first looks up the destination in it's routing table. Based on the routing table it determines ...
user avatar
  • 11.6k
9 votes

Why doesn’t ICMP use port numbers?

Port numbers are a feature of transport layer protocols such as TCP and UDP. ICMP is really part of the internetworking layer (IP), so that attribute doesn't exist at that layer. And yes, I know ...
user avatar
  • 62.5k
9 votes

Does a router send frames or packets?

it seems that routers decapsulate the frame on arrival, and encapsulate the packet in a frame in order to send it. Yes. A router must strip off the layer-2 frame in order to get to the layer-3 ...
user avatar
  • 93.6k
8 votes
Accepted

ICMP response to source IP when the payload of IP packet is not ICMP?

Yes, the router that decrements the TTL to 0 will discard the packet and send an ICMP time exceeded message (type 11) to the source.
user avatar
  • 62.5k
8 votes

I can ping but ports are closed

TCP port 7 ('echo') and ICMP echo request messages are two very different things. Ping uses ICMP echo messages, which (since it's ICMP) do not use TCP. So this has nothing to do with TCP ports being ...
user avatar
  • 15.6k
8 votes
Accepted

Strange router's MAC address from ICMP Echo Reply?

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the ...
user avatar
  • 93.6k
8 votes

PING port number?

As others have already stated, in general pings are ICMP-based and have no ports. There is, however, such a thing as TCP Ping where, instead of the typical 3-way TCP handshake, only the first 2 steps ...
user avatar
  • 4,481
8 votes

When is 'Timestamp' and 'Timestamp Reply' are used in ICMP protocol?

The usual ping command uses ECHO REQUEST and ECHO REPLY, as you've seen. It does indeed locally keep track of sent time and matches with the incoming reply to determine the round trip time. ...
user avatar
  • 15.9k
8 votes
Accepted

Are ICMP Redirect messages really bad?

ICMP re-directs are most often seen when you have a host or router A in the same subnet with two other routers B & C and connectivity to both. Consider the following network: |__192.168.1.0/...
user avatar
8 votes

Why can I traceroute to this IP address, but not ping?

Let's look at what happens, shall we? 8.8.8.8 makes a good example, because at least from my location, I can reach it both with traceroute and ping. First let's try ping 8.8.8.8 and watch what ...
user avatar
7 votes

ICMP packet with correct mac address but wrong ip address

It is as you said. The computer with that MAC address will receive the ethernet frame, since on layer 2 it's all good. Then, looking at layer 3, it will discard the IP packet, since the IP address is ...
user avatar
  • 15.6k
7 votes
Accepted

Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page?

There is much controversy about which protocols run at which layers in the models. Understand that the models, e.g. OSI Model, are just models, and the real world is often different. There are ...
user avatar
  • 93.6k
7 votes

Difference between ping timed out and destination host unreachable

The Request timed out. is while the destination MAC address is still in the source/router's ARP cache. The Reply from 192.168.2.120: Destination host unreachable. is after the destination MAC address ...
user avatar
  • 93.6k

Only top scored, non community-wiki answers of a minimum length are eligible