Hot answers tagged

92

The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports! See RFC792 for further details.


44

On a similar question here Luke Savage explained it perfectly: Traceroute is not a protocol itself, it is an application and the protocols used depends on the implementation your are using. Primarily this is ICMP. There are two main implementations: tracert - tracert is a Windows application that utilises ICMP packets with as incrementing TTL field to map ...


23

The round trip time is not actually stored anywhere. The sending host remembers the time it sends each ICMP Echo Request message, using ICMP's 16-bit identifier and sequence fields. When it gets the ICMP Echo Reply, it notes the current time, finds the time it sent the matching Request packet identified by the reply, calculates the difference, and reports ...


22

So needless to say, nobody on the planet knows how many nodes there are between here and there. I know how many nodes. There are exactly 16. The reason you get different responses is because different operating systems use different starting values for TTL. Some devices use 255, while others use 63. So, one of the devices you are pinging sends the ...


18

To add to @naïveRSA's answer, if there's filtering/firewalling in the path one could also have the situation where an ICMP "echo reply" (ping) packet is blocked, but an ICMP "time exceeded" (tracert) packet is allowed. This would give the same results even when only ICMP (Windows) is used. In both cases (sender using either UDP or ICMP) the error ...


17

That is a routing loop. The router with IP address 74.117.154.1 keeps sending your packets to another router (74.117.154.4), which keeps sending them back to 74.117.154.1. They keep doing this until the TTL of the packet reaches zero, and the packet is discarded. This cannot be caused by your bind9 setup, something is wrong with the configuration of the ...


15

Actually, the ping gets sent to a layer-2 address if they are on the same LAN. Assuming ethernet, the sending host may have a MAC address in its ARP cache, and the pings gets sent to the host with that MAC address (end of story). If the host needs to send an ARP request to resolve the layer-3 IP address to a layer-2 MAC address, this is where it gets tricky....


14

You seem to be missing the ip routing command which enables L3 routing on the switch.


14

I'd like to give you an additional answer especially to this part of the question: ... someone says ICMP uses Port 7 Port 7 (both TCP and UDP) is used for the "echo" service. If this service is available on a computer, UDP port 7 could be used instead of ICMP to perform a "ping". However, most modern computers don't have the "echo" service running, so ...


13

IP protocol provides no guarantee that packets will arrive, arrive on time, or arrive in the proper order. The only thing IP can verify is that the packet header is intact (due to the header checksum). So if a ping is lost, it is...lost. It is up to the sending program to detect that no corresponding reply was received. If you want to guarantee ...


11

Not all machines will answer a broadcast ping. (all broadcast -- 255.255.255.255, or subnet broadcast -- eg. x.x.x.255) Some see it as a "security feature", because one could spoof the origin to flood any host on the network.


11

What happens with a ping when it enters a network? Does the router redirects it to one of the devices on the network, or it sends the reply itself? A router routes packets towards the destination. An IP packet with ICMP payload (ICMP ping request) is treated no differently than any other packet. With "enter a network" you might be referring to routing a ...


10

Running "ping -M do -s 1490 example.com" says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding IP header, frame size becomes 1518 bytes. Frame size can't exceed MTU size of the interface. As from the error message, MTU for the interface is 1500 bytes. So, ...


10

A PC in a private IP range can't be acccesed from the public internet. Devices in private range connecting to internet use a proxy or router/NAT device that replaces the local source IP for a single public IP address that redides in your router/NAT. However, you can make an exception to that, opening a port in the router and allowing that traffic directed ...


9

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to the frame before sending it on the wire. This IP-to-MAC mapping is exactly what the ARP process is there to provide to the host. Based on this statement, one ...


9

First we need to understand how packets are sent. When a host or router tries to send an IPv4 packet* it first looks up the destination in it's routing table. Based on the routing table it determines the "next hop IP address" and interface. For a machine on a local subnet the "next hop IP address" will be the IP address of the destination, otherwise it will ...


8

TCP port 7 ('echo') and ICMP echo request messages are two very different things. Ping uses ICMP echo messages, which (since it's ICMP) do not use TCP. So this has nothing to do with TCP ports being open or closed, you can't "ping" TCP ports using the ping utility. My guess would be that nmap scans 1000 ports by default because those are most of the well ...


8

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the end of the MAC address is the HSRP group number. HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything ...


8

The biggest reason is that the return path from the destination back to you may depend on the source address. Often you want to test the network path in both directions. Furthermore things like policy routing, ingress filtering, firewalls, NAT etc may behave differently depending on the source address.


8

Twisted pair cable used for the local loop has a velocity factor of about .58 - each km of cable takes ca. 6 µs to travel, adding ca. 12 µs to latency. The rest of the Internet probably uses fiber with a VF of .67, resulting in ca. 10 µs or .01 ms latency per km. ADSL has a basic encoding latency of around 10 ms. However, your ISP may likely interleave DSL ...


8

The usual ping command uses ECHO REQUEST and ECHO REPLY, as you've seen. It does indeed locally keep track of sent time and matches with the incoming reply to determine the round trip time. TIMESTAMP and TIMESTAMP REPLY are pretty rare, and many sites simply don't answer, as many systems managers believe it to be a security issue, albeit minor. The ...


8

Firstly you can check functionality of CAT cable by LAN CABLE TESTERS Even functionality of cable can be even ensured by verfiying LED lamps of network devices like firewalls ,switches ,routers &NIC card indication lamps on PC's and servers By verfiying Mac address learning status from connected devices we can ensure connectivity status of devices for ...


8

From reading on the web I understand that 28 bytes is reserved for ICMP so my actual MTU is 1472. No, the MTU is size of the payload of the data-link protocol. For ethernet, that is 1500. You are confusing the network layers. Network-layer, e.g. IP, packets are the payload of the data-link protocol, so the MTU is how large the network packet can be, but the ...


7

I's not exactly the answer at your question, but that a simple (but limited) way to do (in certain case) what you want. I'm coping-post the option -R of ping man page: -R Record route. Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. Note that the IP header is only large enough for nine ...


7

The Request timed out. is while the destination MAC address is still in the source/router's ARP cache. The Reply from 192.168.2.120: Destination host unreachable. is after the destination MAC address has timed out of the source/router's ARP cache, and the source/router no longer has, or can get, a MAC address for the destination. Eventually, the destination ...


7

You have all your interfaces in the same subnet. That is not going to work. Your computer can't figure out which interface to use to send to each host because it believes they are reachable from any interface. If you insist on this configuration, make each link a different subnet. For the node 1-2 link, use 10.0.1.0/24; for the node 2-3 link, use 10.0.2....


7

As others have already stated, in general pings are ICMP-based and have no ports. There is, however, such a thing as TCP Ping where, instead of the typical 3-way TCP handshake, only the first 2 steps are performed and the delay between is measured. Once the measurement has completed, a RST ACK is sent to close the half-open connection. Then the process ...


7

The entire address block 127.0.0.0/8 is the block of loopback addresses for a host. There are RFCs that explain this. The goes back at least as far as RFC 990, ASSIGNED NUMBERS: The class A network number 127 is assigned the "loopback" function, that is, a datagram sent by a higher level protocol to a network 127 address should loop back inside the ...


7

On a directly connected layer-2 network/segment, IP communication works by encapsulating IP packets into layer-2 frames addressed to the destination's MAC. The source learns the destination's MAC address by using ARP (IPv4) or NDP (IPv6). The switch doesn't see the IP packet within the Ethernet frame, but it looks at the frame's MAC addresses. The ...


7

Let's look at what happens, shall we? 8.8.8.8 makes a good example, because at least from my location, I can reach it both with traceroute and ping. First let's try ping 8.8.8.8 and watch what happens: $ tcpdump -n host 8.8.8.8 or icmp 15:36:51.045994 IP 10.4.27.179 > 8.8.8.8: ICMP echo request, id 7215, seq 0, length 64 15:36:51.062458 IP 8.8.8.8 > ...


Only top voted, non community-wiki answers of a minimum length are eligible