How does ping work, and what can a failed ping tell you?
Show the answer
Say this first
Ping sends ICMP echo requests (type 8) and waits for echo replies (type 0). A reply proves two-way IP
reachability for ICMP and gives round-trip time and loss. A failure is only useful once you read why:
a timeout means something dropped the request or the reply, destination unreachable (type 3) names the
router that could not deliver, and TTL exceeded (type 11) points at a loop. On Cisco, ! is a reply,
. is a timeout and U is an unreachable.
Go deeper
What travels
Echo request is ICMP type 8 code 0, carrying an identifier, a sequence number and a data payload. Echo reply is type 0. ICMP is IP protocol 1. Because the reply has to come back, ping tests both directions.
Defaults worth knowing
- Cisco IOS: 5 echoes, 100-byte datagrams (the size includes the IP header), 2-second timeout.
- Windows: 4 echoes with 32 bytes of data.
- Linux: runs until you stop it, 56 bytes of data (64 bytes of ICMP with the header).
Cisco ping characters
| Char | Meaning |
|---|---|
! | reply received |
. | timed out waiting for a reply |
U | destination unreachable received |
M | could not fragment (DF set, packet too big) |
Q | source quench (obsolete) |
& | packet lifetime exceeded |
? | unknown packet type |
Why the first ping from a router often shows .!!!!
The router has no ARP entry yet for the next hop or the host. It drops the packet that triggered the ARP request, so the first echo times out and the rest succeed. 80 percent on the first try is normal.
Reading failures
- Timeouts: no route somewhere, a filter, or a host that drops ICMP. Many Windows installs block inbound echo requests in the host firewall.
- Unreachable from a router: that router has no route, or got no ARP answer for the host.
- TTL expired in transit: a routing loop.
They will ask next
A host fails ping but users can browse to it. Why?
Its host firewall drops echo requests, or an ACL in the path allows TCP but not ICMP. Test the real port instead:
Test-NetConnection 10.30.0.15 -Port 443on Windows,nc -vz 10.30.0.15 443on Linux.On Windows you see "Reply from 10.1.1.20 Destination host unreachable", and 10.1.1.20 is your own address. What does that mean?
Your own host generated the unreachable because it could not ARP for the destination or the gateway. Look at layer 2: the VLAN, the port, or whether the target is powered on.
Traps
- Treating a failed ping as proof a host is down. Plenty of hosts and firewalls drop ICMP.
- Forgetting that a ping also tests the return path.