Explain ping.
Packet InterNet Groper (ping) is a CLI tool used to check reachability of a host by sending ICMP ECHO_REQUEST packet to target host and waits to see if host responds.
The program reports error, packet loss and round trip time (RTT).
What protocol does ping use?
Internet Control Message Protocol (ICMP)
What could it mean if ping isn’t working?
It could mean one of the following
- host is dead
- connection problems in hardware
- firewall in front of target host has blocked ICMP echo requests
- DNS is not working (in this case, numeric IP address should be used when pinging)
What is the default interval between sending each packet during ping in Linux? How can we change it?
Default interval: 1 second
To change the interval: ping -i 3 www.example.com
How to make ping stop sending packets after a particular count?
Windows: ping -n 5 www.example.com
Linux: ping -c 5 www.example.com
Which ping switch is used to ping host until externally stopped?
Windows: ping -t www.example.com
Which ping switch in Linux is used to check the response of the network under high-load conditions?
ping -f www.example.com
- will flood the host with ping requests
- only root can use this option
How does ping work?
- If the host name is given, then DNS lookup is performed to fetch IP address. If IP address is provided then this step is skipped.
- At network layer, ICMP packets are created containing source IP address, destination IP address, data and protocol field.
- ARP is used to identify the MAC address of destination host. ARP first checks its cache for this address; if not present, it broadcasts the destination’s IP address on subnet to check if the address belongs to same subnet.
- If no response is received, it is assumed that destination is on remote subnet and the request needs to be routed via default gateway. Default gateway’s IP address is stored in windows machine registry.
- Once default gateway’s MAC address is found using ARP, the ICMP packet is send to data link layer, which encapsulates the packet in source MAC address, destination MAC address and an FCS (Frame Check Sequence).
- The frame is then passed down to physical layer where one bit is placed on wire at a time. This is received by every host on the remote subnet which discards the frame if destination MAC address is not a match.
What is traceroute?
It provides the sequence of gateways through which IP packets travel to reach destination.
The command is
“traceroute hostname”
where hostname can be DNS name or IP address.
Which command to run if do not want tracert to resolve the intermediate IP addresses?
tracert -d google.com
What protocol does traceroute use?
Internet Control Message Protocol (ICMP)
What is the meaning of * in place of one of the RTTs?
No response was received from the router
What is the meaning of * in all the time fields for a given gateway?
No ICMP Time Exceeded error message was received from that particular gateway.
How does traceroute work?
- The ICMP/UDP packet is prepared and sent to the first router with time to live (TTL) value of 1. The clock starts measuring time in ms.
- When the first router receives the packet, it reduces the TTL value by 1, making it zero. When TTL value becomes zero, the packet is dropped and an ICMP Time Exceeded error message is sent back to the source host. The clock pauses, notes the time taken and displays it as delay in ms.
- The sender’s IP address in the header of ICMP Time Exceeded error message identifies the gateway and using DNS lookup, gateway’s hostname is displayed.
- The next set of packets are given TTL value of 2, so the first router forwards the packet (decrementing TTL by 1) but the second router drops the packet (decrementing TTL by 1 and making it zero) and sends back ICMP Time Exceeded error message.
- This process continues until destination is reached and ICMP Echo Reply message is sent back to the source.
What is asymmetric routing?
When the packets take one path to travel from source to destination and another path to travel from destination to source, the configuration is called asymmetric routing.
What does the !N notation mean in traceroute RTT?
Network unreachable error
What does the !H notation mean in traceroute RTT?
Host unreachable error
What does the !P notation mean in traceroute RTT?
Protocol unreachable error
What is MTR program?
My TraceRoute (MTR) is a program which combines functions of traceroute and ping in one network diagnostic tool like Unix/Linux’s top.
What is netstat and what does it do?
Network Statistics (netstat) is a CLI tool that displays network connections, routing table, network interfaces and protocol stats.
It is used for finding problems in network and to determine amount of traffic on a network for performance measurement.
What does the state LISTEN in netstat mean?
It shows the processes that are listening on the network for incoming connections.
We can use netstat -l (small L) to see only listening ports.
What does the state ESTABLISHED in netstat mean?
It means that the connection is currently active.
We can use netstat -a to see all connections.
What does the state TIME_WAIT in netstat mean?
It shows the connections in the process of closing.
What does the state SYN_SENT in netstat mean?
It shows the process that is trying to contact a nonexistent/inaccessible network server.
