Hot answers tagged

94

The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports! See RFC792 for further details.


45

On a similar question here Luke Savage explained it perfectly: Traceroute is not a protocol itself, it is an application and the protocols used depends on the implementation your are using. Primarily this is ICMP. There are two main implementations: tracert - tracert is a Windows application that utilises ICMP packets with as incrementing TTL field to map ...


23

So needless to say, nobody on the planet knows how many nodes there are between here and there. I know how many nodes. There are exactly 16. The reason you get different responses is because different operating systems use different starting values for TTL. Some devices use 255, while others use 63. So, one of the devices you are pinging sends the ...


23

The round trip time is not actually stored anywhere. The sending host remembers the time it sends each ICMP Echo Request message, using ICMP's 16-bit identifier and sequence fields. When it gets the ICMP Echo Reply, it notes the current time, finds the time it sent the matching Request packet identified by the reply, calculates the difference, and reports ...


20

The first version of traceroute was written by Van Jacobson and it used ICMP but it didn't work very well. The vendor interpretation of ICMP in RFC792 was that routers should not send an ICMP error message in response to an ICMP packet (see edit notes below). Therefore most routers would not send a "time exceeded" message in response to an echo request with ...


18

To add to @naïveRSA's answer, if there's filtering/firewalling in the path one could also have the situation where an ICMP "echo reply" (ping) packet is blocked, but an ICMP "time exceeded" (tracert) packet is allowed. This would give the same results even when only ICMP (Windows) is used. In both cases (sender using either UDP or ICMP) the error ...


16

There's no such thing as "UDP ICMP "echo"". traceroute sends a UDP probe with an increasing TTL. That probe is a single datagram destined for a high port which is unlikely to be a listening service. As the datagram flows out across the network, the TTL decrements until it hits zero at which point an ICMP ERROR ("time exceeded") is generated. That ICMP ...


16

I'd like to give you an additional answer especially to this part of the question: ... someone says ICMP uses Port 7 Port 7 (both TCP and UDP) is used for the "echo" service. If this service is available on a computer, UDP port 7 could be used instead of ICMP to perform a "ping". However, most modern computers don't have the "echo" service running, so ...


15

Actually, the ping gets sent to a layer-2 address if they are on the same LAN. Assuming ethernet, the sending host may have a MAC address in its ARP cache, and the pings gets sent to the host with that MAC address (end of story). If the host needs to send an ARP request to resolve the layer-3 IP address to a layer-2 MAC address, this is where it gets tricky....


14

Let me try to answer this, because it's a little more complicated that it may look initially. It seems that you already know the basic operation of traceroute but before anything else here is a very small recap: traceroute tries to determine all the in-between steps from your host to a destination host, or just the distance, i.e. number of hops, from your ...


14

Your client is only sending the first three packets with a TTL of 1. The next three are sent with a TTL of 2. The next three are sent with a TTL of 3. And so on and so forth. An easier way to view this is to set the IP TTL field as its own column in Wireshark. Simply right click on the TTL value in any packet, and select "Apply as Column": From there, ...


12

Not all machines will answer a broadcast ping. (all broadcast -- 255.255.255.255, or subnet broadcast -- eg. x.x.x.255) Some see it as a "security feature", because one could spoof the origin to flood any host on the network.


12

An ICMP Echo request from the DHCP server to the IP address its about to allocate is used to determine if the IP address about to be assigned is already in use on the network. If a response is received from that IP the DHCP server will assign a different address. The ARP request on the newly received address from the client would do the same, check if ...


11

The original RFC for ICMP, RFC777 state that: ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module. This statement is also present in RFC792 which obsoletes RFC777.


11

1) Traceroute may attempt to resolve the hop's domain name via DNS. As you didn't include any additional flags to explicitly enable this functionality, your traceroute application does so by default. If you just see an IP address, it wasn't able to resolve it. 2) This is because a different path was taken on successive traces. Since traceroute works by ...


10

The new ICMP message type as defined in this RFC actually was added to the ICMP standard - though it's currently listed as Historic in RFC 6918: 2.6. Traceroute (Type 30) This message type is specified in [RFC1393] and was meant to provide an alternative means to discover the path to a destination system. This message type has never been widely ...


10

Running "ping -M do -s 1490 example.com" says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding IP header, frame size becomes 1518 bytes. Frame size can't exceed MTU size of the interface. As from the error message, MTU for the interface is 1500 bytes. So, ...


9

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to the frame before sending it on the wire. This IP-to-MAC mapping is exactly what the ARP process is there to provide to the host. Based on this statement, one ...


9

First we need to understand how packets are sent. When a host or router tries to send an IPv4 packet* it first looks up the destination in it's routing table. Based on the routing table it determines the "next hop IP address" and interface. For a machine on a local subnet the "next hop IP address" will be the IP address of the destination, otherwise it will ...


9

Port numbers are a feature of transport layer protocols such as TCP and UDP. ICMP is really part of the internetworking layer (IP), so that attribute doesn't exist at that layer. And yes, I know that ICMP is encapsulated in IP, but it still is considered part of the internetworking layer. That just shows the limitations of the model. To quote from RFC ...


9

it seems that routers decapsulate the frame on arrival, and encapsulate the packet in a frame in order to send it. Yes. A router must strip off the layer-2 frame in order to get to the layer-3 packet. The router then routes the packet to the next interface toward the destination, based on the layer-3 destination address. At the next interface, it must ...


8

TCP port 7 ('echo') and ICMP echo request messages are two very different things. Ping uses ICMP echo messages, which (since it's ICMP) do not use TCP. So this has nothing to do with TCP ports being open or closed, you can't "ping" TCP ports using the ping utility. My guess would be that nmap scans 1000 ports by default because those are most of the well ...


8

Yes, the router that decrements the TTL to 0 will discard the packet and send an ICMP time exceeded message (type 11) to the source.


8

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the end of the MAC address is the HSRP group number. HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything ...


8

As others have already stated, in general pings are ICMP-based and have no ports. There is, however, such a thing as TCP Ping where, instead of the typical 3-way TCP handshake, only the first 2 steps are performed and the delay between is measured. Once the measurement has completed, a RST ACK is sent to close the half-open connection. Then the process ...


8

The usual ping command uses ECHO REQUEST and ECHO REPLY, as you've seen. It does indeed locally keep track of sent time and matches with the incoming reply to determine the round trip time. TIMESTAMP and TIMESTAMP REPLY are pretty rare, and many sites simply don't answer, as many systems managers believe it to be a security issue, albeit minor. The ...


8

ICMP re-directs are most often seen when you have a host or router A in the same subnet with two other routers B & C and connectivity to both. Consider the following network: |__192.168.1.0/24__| | | | | | |___192.168.8.0/24__| | | | | B C |____|_____|____| | | | A A ...


8

Firstly you can check functionality of CAT cable by LAN CABLE TESTERS Even functionality of cable can be even ensured by verfiying LED lamps of network devices like firewalls ,switches ,routers &NIC card indication lamps on PC's and servers By verfiying Mac address learning status from connected devices we can ensure connectivity status of devices for ...


8

From reading on the web I understand that 28 bytes is reserved for ICMP so my actual MTU is 1472. No, the MTU is size of the payload of the data-link protocol. For ethernet, that is 1500. You are confusing the network layers. Network-layer, e.g. IP, packets are the payload of the data-link protocol, so the MTU is how large the network packet can be, but the ...


7

It is as you said. The computer with that MAC address will receive the ethernet frame, since on layer 2 it's all good. Then, looking at layer 3, it will discard the IP packet, since the IP address is incorrect.


Only top voted, non community-wiki answers of a minimum length are eligible