TCS - Crystal clear on PING

Crystal clear on PING

by Kevin Wood
From the March 2001 issue of the I/O Port Newsletter

We all know the protocol for the internet (and currently most networks as well) is TCP/IP. For some, that is the extent of their knowledge. If they try to open a web site, the ensuing error message if the connection fails means nothing to them. If you are happy with that level on expertise, read no further.

There is a simple tool that can help determine if there is a problem, and if so where the problem lies. Most Network administrators use this program in their diagnostic toolkit. Best of all, it is affordable to even the cheapest of us (it is FREE!) OK you probably already have it. The utility is PING. This article will give you the basics needed to amuse and astound your friends (even the Computer Geek types.)

Open a command prompt on your computer. (Notice how I didn't even ask what version of Windows or NT you were running that was deliberate)

Type (Without the quotes, but with the space) "ping www.mindspring.com" You probably got one of the responses below.

Pinging www.mindspring.com [199.174.114.46] with 32 bytes of data:

Reply from 199.174.114.46: bytes=32 time=50ms TTL=50

This means

  1. Mindspring is up and running (You got a response)
  2. A Name server is running (Computers only recognize numbers, so a server turned www.mindspring.com into 199.174.114.46)

If you got 'unknown host www.mindspring.com'
Your computer is not communicating with a name server. (Are you connected to the internet?

If you got: 'Request timed out'
Either you typed in an incorrect IP address (If you tried to get smart from response 1 above and entered 'ping 199.174.114.46' or the machine you are trying to ping is not on or connected to the network.

You may sometimes get the message: 'Destination net is unreachable.'
This is like a bridge being out between you and the destination. Until the bridge is repaired, you cannot get there from here.

Now for the 'Power User' stuff that will impress your friends.
Many times, I know a machine is being re-booted. How can I tell when the remote site is back up and running? Type 'ping -t' The t makes your computer keep pinging the remote computer till you close the DOS window. So youre screen will look something like:

Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Request timed out
Request timed out
Request timed out
Request timed out
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50
Reply from 199.174.114.46: bytes=32 time=50ms TTL=50

Can you tell when the remote machine was re-booting? I'll bet you can figure it out.

Unless your computer is connected directly to the computer you are trying to 'ping' there are routers between you and the destination computer. Want to know what those routers are named? OK. At the command prompt (DOS Window) type the following command: Tracert www.mindspring.com You should see something like this: (Unless you are sitting next to me, your numbers will differ)

Tracing route to www.mindspring.com [199.174.114.46] over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms 158.229.2.126
2 <10 ms <10 ms <10 ms 158.229.15.1
3 <10 ms * <10 ms 158.229.225.2
4 * * * Request timed out.
5 * * * Request timed out.
6 30 ms 31 ms <10 ms talhub.tlxd.tal.sprintnetops.net [143.190.1.109]
7 <10 ms 10 ms 10 ms 199.250.21.210
8 20 ms 10 ms <10 ms 199.250.21.230
9 <10 ms 10 ms <10 ms inthub.dms.state.fl.us [204.90.26.110]
10 <10 ms 10 ms 10 ms hcsisp.dms.state.fl.us [204.90.26.102]
11 20 ms 10 ms 20 ms 500.Serial12-1-1.GW1.JAX1.ALTER.NET [157.130.81.185]
12 20 ms 20 ms 20 ms 153.at-2-1-0.XR1.ATL1.ALTER.NET [152.63.84.34]
13 30 ms 20 ms 30 ms 195.ATM4-0.GW6.ATL3.ALTER.NET [146.188.233.217]
14 50 ms 30 ms 20 ms foundry-86-p3-2.atl2.mindspring.net [157.130.29.194]
15 20 ms 20 ms 20 ms web-ftp03.mindspring.com [199.174.114.46]

Trace complete.

This lists the different routers through which the ping signal went to get from my computer to the server at Mindspring. You will notice some time outs in the middle. No those sites are not down (or I would not have been able to get a response back from Mindspring.) For security reasons, those routers are configured to NOT respond to ping messages. This keeps hackers from sending a 'ping' to a range of addresses to see who responds, then attacking those who do.

Now this is where you can amaze those computer geeks you know. Here is the tracert response between 158.229.2.100 and 158.229.1.41 Tracing route to tmphqsms.tempfldoi.gov [158.229.1.41] over a maximum of 30 hops:

1 <10 ms <10 ms <10 ms 158.229.2.126
2 <10 ms <10 ms <10 ms tmphqsms.tempfldoi.gov [158.229.1.41]

Trace complete.

With Windows 2000, you can enter pathping 158.229.1.41 and get the following information.

Tracing route to tmphqsms.tempfldoi.gov [158.229.1.41] over a maximum of 30 hops:
0 rp038585.FLDOI.GOV [158.229.2.100]
1 158.229.2.126
2 tmphqsms.tempfldoi.gov [158.229.1.41]

You see my machine, 1 router and the destination machine. (This only works on Windows 2000 machines, but do not worry, this and tracert do not give you the entire story!)

A router HAS to have an IP address on BOTH sides. The side your 'ping' signal goes in on, and the side the 'ping signal comes out on. But while both tracert (which everyone running TCP/IP and windows has) and pathping (which only windows 2000 users have) only show one IP address for the router in the middle. In this example, there is only one router. We saw several routers between my computer and mindspring. If the tracert between my computer and mindspring stopped at:
1 <10 ms <10 ms <10 ms 158.229.2.126
2 <10 ms <10 ms <10 ms 158.229.15.1
3 <10 ms * <10 ms 158.229.225.2
4 * * * Request timed out.
5 * * * Request timed out.
6 30 ms 31 ms <10 ms talhub.tlxd.tal.sprintnetops.net [143.190.1.109]
7 <10 ms 10 ms 10 ms 199.250.21.210
8 20 ms 10 ms <10 ms 199.250.21.230
9 * * * Request timed out.

I might assume that router number 9 was down. However, if my 'ping' signal went into router number 8, but never came back out on the same side of the router as router number 9, I would get the same response. I might call or send a technician to 'fix' router number 9, when it is operating fine.

Now try this:
Ping -r 9
When I enter 'ping 158.229.1.41 r 9' I get the following response:

Reply from 158.229.1.41: bytes=32 time<10ms TTL=127
Route: 158.229.1.126 ->
158.229.1.41 ->
158.229.2.125

I got an extra response. That additional response is the 'other' IP address on the router between myself and the remote computer. (And as we know, any windows machine using TCP/IP can use 'ping') Many of your 'computer geek' friends are not aware of this limitation to tracert or this means of using ping.

Kevin Wood has contributed several articles to APCUG for use in Reports or as a filler to send out to our editors. If you use this article please send him an email letting him know.

There is no restriction against anyone using the article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an International organization to which this user group belongs.



For more information on the Tulsa Computer Society click here



This page has been accessed times.
Tulsa Computer Society 2/01/2001
Don Singleton, President
djs@ionet.net