Basics,Linux,TCP-IP
2013/08/09
Ping is a very useful network diagnostic tool and is often the first thing we turn to when we have
network issues. While it's true that a successful "ping" doesn't necessarily mean that higher level
connectivity is working, the lack of a ping response from something that should respond almost certainly
indicates network problems or a downed host. Slow ping responses usually mean slow networks, so
ping is a convenient way to get some idea of network latency and congestion too.
It don't mean a thing if it ain't got that ping- Dirk Hart
At that simple level ("ping somehost"), we can't go too far wrong. The host responds or it doesn't, the speed of the response is what we expect or it isn't. There could be missing or duplicated responses (see below) but most of
the time it is pretty straight forward.
Where we might get into trouble is when we want to alter pings behavior or aren't aware of its behavior. For example, Windows folk are often confused because Unix/Linux pings don't stop automatically - by default they keep pinging until you interrupt them (Ctrl-C, DEL or whatever the INTERRUPT sequence is - use CTRL-\ if all else fails).
Different systems can use very different flags for common functions:
You can see how that might get you in trouble! Read the man page - read it even if you think you know ping inside
and out, because you may not.
What can I check if ping doesn't work at all?
(Also see A non-technical guide to understanding and fixing TCP/IP problems on a network.)
Did you try "ping localhost"? If you can't do that, you aren't going to
ping anything else!
First, are you sure that the address, netmask and broadcast are
correct? Your broadcast should be the inverse of of your netmask.
For example, if your ip address is 192.168.2.3 and your netmask is
255.255.255.0, your broadcast should be 192.168.2.255, but if the
netmask were 255.255.0.0, the broadcast would be 192.168.255.255.
If the netmask does not match the netmask of the OTHER machines
on the network, you can have strange results like being able to
ping machine X but machine X can't ping you.
Ping by ip address rather than name. If that works, your problem
is name resolution, not anything else.
Are you sure your ip address is unique? Try pinging it from some
other machine with this one turned off- obviously you should get
nothing.
If you are on the same network and are able to, check "arp -a" on the other machine. Does it
show the expected MAC address for the IP you are pinging from? Does it have any arp entry?
Do you have a physical connection? You should be seeing network
traffic on the lights of your nic if you are connected to a hub
(not with a switch- unless the traffic is broadcast or directed to
your ip specifically), and if you unplug the patch cord, the lights
at the hub or switch should go out- if they don't, obviously you
aren't plugged in where you think you are.
Is your cable good? Swap it with a working system to check.
Move the machine to another place on the network- maybe the
wiring is bad just here.
Routes all look good? netstat -rn shows you. If you are seeing
unexpected routes, a rip enabled router may be feeding you bad
info. Turn off rip by killing the routed process and make sure it
doesn't restart by editing it out of /etc/tcp. Find the line that
reads "/etc/routed &" and put a "#" in front of it.
Ping is slow
DNS lookups might be at fault - try "ping -n" and see Ping is really slow.
DUP ping
The "DUP" means that "ping" received two replies to one enquiry - the
icmp_sequence number is duplicated.
The Linux man page says:
This almost certainly means faulty or misconfigured equipment somewhere - for example a bad netmask setting can cause one or the other machine to be on the "wrong" subnet (whichever one is wrong).
Bonding NICS can also cause this.
VMware has also caused this sort of DUP confusion, as have other virtualization products.
An anonymous person sent this:
Here's another similar issue.
Pings out of order
You'd expect sequential responses normally:
But (taken from Curious pings on SCO) here's something different:
The poster commented "The ping looks like a sinus curve, running in a loop."
What happened there?
You can read that thread for various interpretations (slow DNS, DNS caching, packet caching and more) but my guess is that some of the packets may have traveled over a lower speed link (load splitting) or took a network path that
just took longer to respond (busy?). Out of order delivery isn't necessarily a problem (TCP/IP expects that to happen) though obviously a lot of it will slow things down.
Intermittent ping timeout
If you see a timeout in the middle of succesful pings, what happened?
First, "ping" does have a default timeout and a very busy machine just might not have gotten around to responding in time. Internet network congestion could also. Software could cause that: here is a case where Symantec Endpoint Protection seemed to be at fault.
This case turned out to be IP conflicts.
What if the other side deliberately doesn't respond to ping?
There are other tools, but tcpping is "ping-like".
Nmap is another possibility; see How to ping a TCP or UDP port with nmap and nping..
hping is yet another.
Ping6
On this Ubuntu system, ping and ping 6 are obviously different:
But their man pages are identical.
The OS X and BSD man page is different and includes this:
Oddities
Ping Tunnel - For those times when everything else is blocked..
Comments: Click Here.
Want to showcase your product to our audience? Check our advertising options.
Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them.
I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you
to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. If you have any question, please do feel free to contact me.
-
Samepage - Redefining how people create and share information
-
Kerio Mail Server, Firewall and more