Chapter 1: Introduction to Networking

Ping and Tracert

These notes guide you through understanding the ping and tracert commands.

Introduction
The ping Command
The tracert Command
Troubleshooting
Summary

Introduction

Tracert and ping are two command line utilities that are included in Windows and most other operating systems. Both utilities are useful in troubleshooting connectivity problems on a network. By combining ping and tracert it is usually possible to work out which part of a network is causing problems.

The ping Command

Ping is mainly used for testing that a connection to another device can be made, that the device is alive and well. Ping stands for Packet Internet Groper.

In Windows, both ping and tracert run under MS-DOS. So to run them you have to open the command prompt. To find the command prompt, click the START menu, select Programs then Acessories, then the Command Prompt. The actual location of the command prompt can vary for different version of Windows but you should find it somewhere on the the START menu.

Ping a host

The basic ping command syntax is 'ping host'.

For example, ping www.cisco.com should produce output similar to...

The ping command sends four ICMP packets to the target. ICMP stands for Internet Control Message Protocol. If the target sends a reply in response to the packets then you know that the target is alive. You should be aware that sometimes a firewall between you and the target may be configured to block the ICMP packets. This means you will not get a reply and although you may think that the target is down it is actually alive and well but hidden behind a firewall.

Another use for ping is determining the connection speed between the sending computer and the target host. In the example above, the average round trip time is 154 milliseconds.

Ping localhost

What ping really does is test the targets NIC transmit/receive capability and the health of its TCP/IP stack. Network administrators frequently use ping to test the functionality of a host's NIC.

If a host does not reply to a ping and you know it should then it is possible that the TCP/IP configuration is incorrect, or the NIC itself is malfunctioning.

When an administrator installsand configures a network card you can be sure they will use ping to test the NIC is working properly. It is not necessary to ping the host from another computer, you can get a computer to ping itself.

The command for a computer to ping itself is..

ping localhost

or

ping 127.0.0.1

Both localhost and 127.0.0.1 are ways for the computer to refer to itself.

The tracert Command

The tracert command is interesting in that it shows how many hops are necessary to connect from some-device to some-other-device.

Like ping, tracert uses ICMP packets to provide you with information about the connection to your target. Specifically, tracert reports the route that your packets take in getting to the target you're trying to reach.

The basic tracert command syntax is 'tracert host'.

For example, tracert www.cisco.com should produce output similar to..

The tracert command lists various devices, such as routers or gateways you have to pass through to get to the target and shows you three ping times to each of those devices. The distance between one device and the next is called a "hop." 

The trace to www.cisco.com is interesting. The first hop times out. I.e.

1      * * * Request timed out.

This means the device at that hop did not respond to an ICMP packet. This is likely due to a firewall ignoring the packet. You might wonder how tracert knows there is a device at hop 1 if the device does not respond. Well, it uses the TTL value.

All ICMP packets include a TTL value. The default value for Windows is 128. Every time a device forwards a packet, it decreases the TTL value by 1. Eventually, if the route is long enough, the TTL value may reach the value of 1 and the device that receives the packet with the TTL value of 1 sends back a 'TTL expired in transit'.

Tracert exploits this 'TTL expired in transit' behaviour by sending the first packet with a TTL value of 1 (instead of 128), hoping for an expired message from the first device. Then it sends the next packet with a TTL value of 2, hoping the second device will send an expired message, then it sends the next packet with the TTL value increased to 3 and so on, until the destination is reached.

Since the first device did not respond to the first ICMP packet but the second device sent an expired message, then tracert deduces there is a silent device at hop 1.

The trace above showed 19 hops between my computer and cisco's web site. The trace did not make it all the way, again probably due to a firewall.

There are plenty of utilities on the Internet, some free, some not, that do the same job as ping and tracert. Here is an example of software that traces a route and represents it visually.

Troubleshooting

The two utilities ping and tracert are extremely useful in troubleshooting connectivity problems with devices on a network. They are both useful but in different ways.

Test the TCP/IP Configuration of a Host

When a host has connection problems, one of the first steps to diagnosing the problem is to use the ping command. If you are at the console of the host with the connection problems you would follow these steps...

• ping 127.0.0.1 - this is the internal loopback test. It verifies the NIC can transmit/receive and the health of the TCP/IP stack
     
• ping the IP address of a host - this tests that the host has a valid IP address configuration
     
• ping the IP address of the gateway - this tests that the host knows where the gateway is and that it can connect to it. Also, if you have any doubts about the gateway, it checks that the gateway itself is alive and functioning.
     
• ping a remote target - this tests that you can connect to a remote host outside the gateway. Choosing a target on the Internet is common.

Test devices on-route to the Host

Sometimes, there is nothing wrong with the NIC or TCP/IP configuration of a host, but you still cannot connect to it and pinging the host remotely illicits no response. Assuming the ping command is not being blocked by a firewall between you and the target, then it is likely that a device between you and the target is malfunctioning.

You can locate the malfunctioning device by using the tracert command.

• tracert target IP address - any hop along the way to the target that illicits a time-out response is likely to be the malfunctioning device.

Summary

On completing these notes you should:-

• be familiar with the ping command
• be familiar with the tracert command
• have an idea how troubleshoot network connectivity problems