Hot answers tagged

66

The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports! See RFC792 for further details.


39

On a similar question here Luke Savage explained it perfectly: Traceroute is not a protocol itself, it is an application and the protocols used depends on the implementation your are using. Primarily this is ICMP. There are two main implementations: tracert - tracert is a Windows application that utilises ICMP packets with as incrementing TTL ...


23

The round trip time is not actually stored anywhere. The sending host remembers the time it sends each ICMP Echo Request message, using ICMP's 16-bit identifier and sequence fields. When it gets the ICMP Echo Reply, it notes the current time, finds the time it sent the matching Request packet identified by the reply, calculates the difference, and reports ...


22

So needless to say, nobody on the planet knows how many nodes there are between here and there. I know how many nodes. There are exactly 16. The reason you get different responses is because different operating systems use different starting values for TTL. Some devices use 255, while others use 63. So, one of the devices you are pinging sends the ...


17

To add to @naïveRSA's answer, if there's filtering/firewalling in the path one could also have the situation where an ICMP "echo reply" (ping) packet is blocked, but an ICMP "time exceeded" (tracert) packet is allowed. This would give the same results even when only ICMP (Windows) is used. In both cases (sender using either UDP or ICMP) the error ...


15

That is a routing loop. The router with IP address 74.117.154.1 keeps sending your packets to another router (74.117.154.4), which keeps sending them back to 74.117.154.1. They keep doing this until the TTL of the packet reaches zero, and the packet is discarded. This cannot be caused by your bind9 setup, something is wrong with the configuration of the ...


14

You seem to be missing the ip routing command which enables L3 routing on the switch.


13

IP protocol provides no guarantee that packets will arrive, arrive on time, or arrive in the proper order. The only thing IP can verify is that the packet header is intact (due to the header checksum). So if a ping is lost, it is...lost. It is up to the sending program to detect that no corresponding reply was received. If you want to guarantee ...


13

Actually, the ping gets sent to a layer-2 address if they are on the same LAN. Assuming ethernet, the sending host may have a MAC address in its ARP cache, and the pings gets sent to the host with that MAC address (end of story). If the host needs to send an ARP request to resolve the layer-3 IP address to a layer-2 MAC address, this is where it gets tricky....


9

Short Answer: The answer is that it depends. Longer Explanation: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to the frame before sending it on the wire. This IP-to-MAC mapping is exactly what the ARP process is there to provide to the host. Based on this statement, one ...


9

A PC in a private IP range can't be acccesed from the public internet. Devices in private range connecting to internet use a proxy or router/NAT device that replaces the local source IP for a single public IP address that redides in your router/NAT. However, you can make an exception to that, opening a port in the router and allowing that traffic directed ...


8

Running "ping -M do -s 1490 example.com" says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding IP header, frame size becomes 1518 bytes. Frame size can't exceed MTU size of the interface. As from the error message, MTU for the interface is 1500 bytes. So, ...


8

TCP port 7 ('echo') and ICMP echo request messages are two very different things. Ping uses ICMP echo messages, which (since it's ICMP) do not use TCP. So this has nothing to do with TCP ports being open or closed, you can't "ping" TCP ports using the ping utility. My guess would be that nmap scans 1000 ports by default because those are most of the well ...


8

You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, 0000.0C07.ACxx, which is the MAC address range for HSRP. The 06 on the end of the MAC address is the HSRP group number. HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything ...


8

The biggest reason is that the return path from the destination back to you may depend on the source address. Often you want to test the network path in both directions. Furthermore things like policy routing, ingress filtering, firewalls, NAT etc may behave differently depending on the source address.


7

First we need to understand how packets are sent. When a host or router tries to send an IPv4 packet* it first looks up the destination in it's routing table. Based on the routing table it determines the "next hop IP address" and interface. For a machine on a local subnet the "next hop IP address" will be the IP address of the destination, otherwise it will ...


7

You have all your interfaces in the same subnet. That is not going to work. Your computer can't figure out which interface to use to send to each host because it believes they are reachable from any interface. If you insist on this configuration, make each link a different subnet. For the node 1-2 link, use 10.0.1.0/24; for the node 2-3 link, use 10.0.2....


7

The entire address block 127.0.0.0/8 is the block of loopback addresses for a host. There are RFCs that explain this. The goes back at least as far as RFC 990, ASSIGNED NUMBERS: The class A network number 127 is assigned the "loopback" function, that is, a datagram sent by a higher level protocol to a network 127 address should loop back inside the ...


7

A "L3 switch" will perform the actual packet forwarding (both L2 and L3) using dedicated hardware, but exceptional cases like sending a ping reply or a time exceeded message are normally handled in software by the switch's CPU. Depending on how powerful and busy the CPU is and how the switch vendor decided to prioritize it's different tasks it may take the ...


6

I's not exactly the answer at your question, but that a simple (but limited) way to do (in certain case) what you want. I'm coping-post the option -R of ping man page: -R Record route. Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. Note that the IP header is only large enough for ...


6

My best guess here without more information is that you hooked up a WAN port to your existing network. The new router got an IP from DHCP, along with a default gateway. When you try to ping 192.168.1.1, the packet is routed to your default gateway. For whatever reason, your network routes the packet out to the Internet, where it loops around in no-man's ...


6

You are correct in that if you ping an IP address you are not using DNS. If you are using a hostname instead of an IP address with ping, then you will be using DNS. However, just because you are using ping with an IP address, even if you don't get a response this does not necessarily mean there is a routing problem. Many hosts are configured to rate limit ...


6

Not all machines will answer a broadcast ping. (all broadcast -- 255.255.255.255, or subnet broadcast -- eg. x.x.x.255) Some see it as a "security feature", because one could spoof the origin to flood any host on the network.


6

What happens is desirable. It would not be desirable for an interface with multiple IP addresses to have the ARP cache changed every time one of the different addresses is used. The ARP cache will naturally timeout MAC addresses. You can probably clear the ARP cache, and it will get rebuilt naturally.


6

The Request timed out. is while the destination MAC address is still in the source/router's ARP cache. The Reply from 192.168.2.120: Destination host unreachable. is after the destination MAC address has timed out of the source/router's ARP cache, and the source/router no longer has, or can get, a MAC address for the destination. Eventually, the destination ...


6

I'd like to give you an additional answer especially to this part of the question: ... someone says ICMP uses Port 7 Port 7 (both TCP and UDP) is used for the "echo" service. If this service is available on a computer, UDP port 7 could be used instead of ICMP to perform a "ping". However, most modern computers don't have the "echo" service running, so ...


6

A host knows if the destination address is on a different network (the same way that you do, by masking the host and destination addresses with the host mask). If the destination is on the same network, then it will send the layer-3 packet in a layer-2 frame directly to the destination, otherwise it will send the layer-3 packet in a layer-2 frame directly to ...


6

Twisted pair cable used for the local loop has a velocity factor of about .58 - each km of cable takes ca. 6 µs to travel, adding ca. 12 µs to latency. The rest of the Internet probably uses fiber with a VF of .67, resulting in ca. 10 µs or .01 ms latency per km. ADSL has a basic encoding latency of around 10 ms. However, your ISP may likely interleave DSL ...


6

The usual ping command uses ECHO REQUEST and ECHO REPLY, as you've seen. It does indeed locally keep track of sent time and matches with the incoming reply to determine the round trip time. TIMESTAMP and TIMESTAMP REPLY are pretty rare, and many sites simply don't answer, as many systems managers believe it to be a security issue, albeit minor. The ...


Only top voted, non community-wiki answers of a minimum length are eligible