LFCA 46 🐧 Testing Connectivity — ping, traceroute
When a network connection fails, the question is where it failed. Is the interface up? Is the gateway reachable? Is the DNS resolving? Is the remote host responding? The two commands that answer the reachability questions are ping and traceroute. The ping sends an ICMP echo request and reports whether the reply comes back, how long it took, and how many packets were lost. The traceroute sends the packets with the increasing TTL and reports the hops along the path, which shows where the connection stops. The two together are the first diagnostic after the ip addr and the ip route, and they answer the two questions: “is the host reachable?” and “where does the path break?” This chapter covers the two commands, the ICMP protocol, the options, the interpretation of the output, the failure modes, the common causes, the alternative tools — the mtr, the tcping, the curl — and the patterns that make the diagnosis systematic. It builds on LFCA 41 through 45 and prepares the ground for the firewall and the SSL’s material.
Key point: The ping sends the ICMP echo request to the target and waits for the ICMP echo reply. The reply’s time is the round-trip, and the packet loss’s percentage is the reliability’s. The traceroute sends the packets with the TTL of 1, 2, 3, and so on, and each hop’s router returns the “time exceeded” message, which reveals the path. The ping‘s success means the target is reachable at the ICMP’s level, and the traceroute‘s output shows the path’s hops. The ping can be blocked by the firewall (the ICMP’s filter), and the traceroute can be blocked by the firewall (the UDP’s filter) — a failed ping does not always mean the host is down. The mtr combines the two and shows the live’s statistics. The tcping and the curl test the TCP’s ports, which the ICMP’s tests do not.
The ICMP protocol
The ICMP is the Internet Control Message Protocol, and it is the IP’s companion. It carries the control’s messages — the errors, the diagnostics, the reachability’s — and it is not the TCP’s or the UDP’s. The ICMP is the network layer’s, and the two most common messages are the echo request and the echo reply.
The echo request and the reply. The ping sends the ICMP echo request (the type 8), and the target’s ICMP echo reply (the type 0) comes back. The two are the pair, and the pair is the reachability’s test.
The ping's flow:
The host ── ICMP echo request (type 8) ──► The target
The host ◄── ICMP echo reply (type 0) ─── The targetWhy the ICMP is the layer 3’s. The ICMP is the IP’s, and the IP is the layer 3’s. The ICMP is not the TCP’s or the UDP’s, and the ICMP is the separate. The two are the different, and the different is the layer.
Why the ICMP’s type matters. The type 8 is the echo request, the type 0 is the echo reply, the type 3 is the destination unreachable, the type 11 is the time exceeded. The four are the common, and the common is the diagnostic.
Why the “destination unreachable” matters. The ICMP’s type 3 is the destination unreachable, and the type 3’s code is the specific. The code 0 is the network unreachable, the code 1 is the host unreachable, the code 3 is the port unreachable. The three are the specific, and the specific is the diagnosis.
Why the “time exceeded” matters. The ICMP’s type 11 is the time exceeded, and the type 11’s code is the specific. The code 0 is the TTL’s exceeded in the transit, and the code 1 is the TTL’s exceeded in the reassembly. The two are the specific, and the specific is the traceroute’s.
Why the ICMP is the blocked’s. The ICMP is the blocked’s, and the blocked is the firewall’s. The firewall can block the ICMP’s echo request, and the blocked is the ping’s failure. The two are the pair, and the pair is the false’s negative.
Why the ICMP’s block matters. The ICMP’s block is the false’s negative, and the false’s negative is the ping’s failure. The ping’s failure does not mean the host is down, and the host may be up with the ICMP’s blocked. The two are the pair, and the pair is the diagnosis.
The ping‘s basic usage
The ping sends the echo request and reports the reply. The basic usage is the ping <host>, and the output is the per-packet’s.
ping example.com
# PING example.com (93.184.216.34) 56(84) bytes of data.
# 64 bytes from 93.184.216.34: icmp_seq=1 ttl=56 time=12.3 ms
# 64 bytes from 93.184.216.34: icmp_seq=2 ttl=56 time=11.9 ms
# 64 bytes from 93.184.216.34: icmp_seq=3 ttl=56 time=12.1 ms
# ^C
# --- example.com ping statistics ---
# 3 packets transmitted, 3 received, 0% packet loss, time 2003ms
# rtt min/avg/max/mdev = 11.901/12.100/12.300/0.163 msThe PING example.com (93.184.216.34) is the target’s, and the 56(84) is the packet’s. The icmp_seq=1 is the sequence’s, the ttl=56 is the TTL’s, and the time=12.3 ms is the round-trip’s. The ^C stops the ping, and the statistics are the summary.
Why the ping‘s output matters. The ping‘s output is the per-packet’s, and the per-packet’s is the reply’s. The icmp_seq is the sequence’s, the ttl is the TTL’s, and the time is the round-trip’s. The three are the pair, and the pair is the diagnostic.
Why the icmp_seq matters. The icmp_seq is the sequence’s, and the sequence’s is the order’s. The missing’s sequence is the loss’s, and the loss is the diagnostic. The two are the pair, and the pair is the loss.
Why the ttl matters. The ttl is the remaining’s, and the remaining’s is the hop’s. The TTL’s initial is the 64, the 128, or the 255, and the difference is the hops’. The two are the pair, and the pair is the path.
Why the time matters. The time is the round-trip’s, and the round-trip’s is the latency’s. The 12.3 ms is the round-trip’s, and the round-trip’s is the latency’s. The two are the pair, and the pair is the performance.
Why the statistics matter. The statistics are the summary’s, and the summary’s is the loss’s. The 3 packets transmitted, 3 received, 0% packet loss is the summary’s, and the summary’s is the reliability’s. The two are the pair, and the pair is the reliability.
Why the rtt min/avg/max/mdev matters. The rtt is the round-trip’s, and the min, the avg, the max, the mdev are the four. The four are the statistics’, and the statistics’ is the latency’s. The two are the pair, and the pair is the performance.
Why the ping‘s count matters. The ping -c 4 <host> sends the four, and the four is the count’s. The -c is the count’s, and the count’s is the bounded. The two are the pair, and the pair is the script’s.
ping -c 4 8.8.8.8
# PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
# 64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=12.3 ms
# ...
# --- 8.8.8.8 ping statistics ---
# 4 packets transmitted, 4 received, 0% packet loss, time 3004ms
# rtt min/avg/max/mdev = 12.100/12.250/12.400/0.115 msThe -c 4 is the four’s, and the four is the count’s. The ping stops after the four, and the statistics are the summary’s. The two are the pair, and the pair is the bounded.
Why the -c matters for the script. The -c is the script’s, and the script’s is the bounded. The ping -c 1 <host> is the reachability’s, and the reachability’s is the script’s. The two are the pair, and the pair is the automation.
Why the ping‘s interface matters. The ping -I eth0 <host> binds the interface, and the interface is the specific’s.
ping -I eth0 8.8.8.8The -I eth0 is the interface’s, and the interface’s is the specific’s. The two are the pair, and the pair is the multi-interface’s.
Why the -I matters. The -I is the multi-interface’s, and the multi-interface’s is the specific’s. The host with the two interfaces (the wired and the wireless) uses the -I, and the -I is the choice. The two are the pair, and the pair is the diagnostic.
Why the ping‘s IPv4 and IPv6 matter. The ping is the IPv4’s, and the ping6 (or the ping -6) is the IPv6’s.
ping -4 example.com # the IPv4
ping -6 example.com # the IPv6The -4 and the -6 are the family’s, and the family’s is the specific’s. The two are the pair, and the pair is the diagnostic.
Why the family matters. The family matters for the dual-stack’s, and the dual-stack’s is the two’s. The IPv4 and the IPv6 are the separate, and the separate is the diagnostic. The two are the pair, and the pair is the specific.
The traceroute‘s basic usage
The traceroute sends the packets with the increasing TTL and reports the hops. The basic usage is the traceroute <host>, and the output is the per-hop’s.
traceroute example.com
# traceroute to example.com (93.184.216.34), 30 hops max, 60 byte packets
# 1 _gateway (192.168.1.1) 0.512 ms 0.489 ms 0.475 ms
# 2 10.0.0.1 (10.0.0.1) 2.345 ms 2.312 ms 2.298 ms
# 3 * * *
# 4 93.184.216.34 (93.184.216.34) 12.345 ms 12.312 ms 12.298 msThe traceroute to example.com is the target’s, and the 30 hops max is the limit’s. The 1 _gateway (192.168.1.1) is the first hop’s, and the 0.512 ms is the round-trip’s. The * * * is the no-response’s, and the 93.184.216.34 is the destination’s.
Why the traceroute‘s output matters. The traceroute‘s output is the per-hop’s, and the per-hop’s is the path’s. The 1, the 2, the 3 are the hops’, and the hops’ is the path’s. The two are the pair, and the pair is the path.
Why the hop’s address matters. The hop’s address is the router’s, and the router’s is the interface’s. The 192.168.1.1 is the gateway’s, and the 10.0.0.1 is the ISP’s. The two are the pair, and the pair is the path.
Why the * * * matters. The * * * is the no-response’s, and the no-response’s is the blocked’s. The hop may block the ICMP, or the hop may be the slow’s. The two are the pair, and the pair is the diagnostic.
Why the * * * is not always the failure. The * * * is the no-response’s, and the no-response’s is the not always the failure. The hop can still forward the packet, and the later’s hop can respond. The two are the pair, and the pair is the diagnostic.
Why the traceroute‘s limit matters. The 30 hops max is the limit’s, and the limit’s is the default’s. The -m 64 is the 64’s, and the 64 is the limit’s. The two are the pair, and the pair is the bounded.
traceroute -m 64 example.comThe -m 64 is the limit’s, and the limit’s is the bounded’s. The two are the pair, and the pair is the deep’s path.
Why the traceroute‘s protocol matters. The traceroute uses the UDP by default, and the UDP is the protocol’s. The -I uses the ICMP, and the -T uses the TCP.
traceroute -I example.com # the ICMP
traceroute -T example.com # the TCPThe -I and the -T are the protocol’s, and the protocol’s is the specific’s. The two are the pair, and the pair is the firewall’s.
Why the protocol matters for the firewall. The firewall can block the UDP, and the blocked is the traceroute’s failure. The -I or the -T is the alternative, and the alternative is the workaround. The two are the pair, and the pair is the diagnostic.
Why the traceroute‘s number of queries matters. The -q 1 reduces the queries, and the queries are the per-hop’s.
traceroute -q 1 example.comThe -q 1 is the one’s, and the one is the queries’s. The two are the pair, and the pair is the fast’s.
Why the -q matters. The -q is the fast’s, and the fast’s is the script’s. The default is the three’s, and the three is the reliable’s. The two are the pair, and the pair is the choice.
Why the -n matters. The -n is the no-DNS’s, and the no-DNS’s is the fast’s.
traceroute -n example.comThe -n is the no-DNS’s, and the no-DNS’s is the fast’s. The reverse’s DNS is the slow’s, and the slow is the delay’s. The two are the pair, and the pair is the speed.
Why the -n matters. The -n is the speed’s, and the speed’s is the diagnostic’s. The reverse’s DNS is the slow’s, and the slow is the delay’s. The two are the pair, and the pair is the fast’s.
Why the -w matters. The -w 2 is the two’s, and the two is the timeout’s.
traceroute -w 2 example.comThe -w 2 is the two’s, and the two is the timeout’s. The two are the pair, and the pair is the bounded’s.
Why the -w matters. The -w is the timeout’s, and the timeout’s is the bounded’s. The default is the five’s, and the five is the slow’s. The two are the pair, and the pair is the choice.
The ping‘s failure modes
The ping‘s failure can be the host’s down, the network’s unreachable, the ICMP’s blocked, the DNS’s failure, or the firewall’s. The five are the common, and the common is the diagnosis.
The “Destination Host Unreachable”. The message is the ICMP’s type 3, and the type 3 is the host’s unreachable. The host is the down, or the route is the missing.
ping example.com
# From 192.168.1.1 icmp_seq=1 Destination Host UnreachableThe From 192.168.1.1 is the gateway’s, and the Destination Host Unreachable is the host’s. The two are the pair, and the pair is the unreachable.
Why the “Destination Host Unreachable” matters. The “Destination Host Unreachable” is the gateway’s, and the gateway’s is the report. The host is the down, or the route is the missing. The two are the pair, and the pair is the diagnosis.
The “Network is unreachable”. The message is the local’s, and the local’s is the route’s missing. The default’s route is the missing, and the missing is the interface’s.
ping 8.8.8.8
# connect: Network is unreachableThe connect: Network is unreachable is the route’s, and the route’s is the missing. The two are the pair, and the pair is the diagnosis.
Why the “Network is unreachable” matters. The “Network is unreachable” is the route’s, and the route’s is the missing. The ip route is the check, and the check is the fix. The two are the pair, and the pair is the diagnosis.
The “Name or service not known”. The message is the DNS’s, and the DNS’s is the name’s. The name’s resolution is the failed, and the failed is the DNS’s.
ping example.invalid
# ping: example.invalid: Name or service not knownThe Name or service not known is the DNS’s, and the DNS’s is the name’s. The two are the pair, and the pair is the diagnosis.
Why the “Name or service not known” matters. The “Name or service not known” is the DNS’s, and the DNS’s is the name’s. The dig is the check, and the check is the fix. The two are the pair, and the pair is the diagnosis.
The “100% packet loss”. The message is the summary’s, and the summary’s is the loss’s. The host is the down, or the ICMP is the blocked, or the network is the broken.
ping -c 4 8.8.8.8
# 4 packets transmitted, 0 received, 100% packet loss, time 3004msThe 100% packet loss is the summary’s, and the summary’s is the loss’s. The two are the pair, and the pair is the diagnosis.
Why the “100% packet loss” matters. The 100% packet loss is the loss’s, and the loss’s is the host’s. The host is the down, or the ICMP is the blocked. The two are the pair, and the pair is the diagnosis.
Why the ping’s failure is the not the host’s down. The ping’s failure is the not the host’s down, and the not is the important. The ICMP’s block is the firewall’s, and the firewall’s is the false’s negative. The two are the pair, and the pair is the diagnosis.
Why the TCP’s test matters. The TCP’s test is the alternative, and the alternative is the tcping or the curl.
curl -I https://example.com
# HTTP/2 200The curl -I is the HTTP’s, and the HTTP’s is the TCP’s. The two are the pair, and the pair is the alternative.
Why the curl matters. The curl is the TCP’s, and the TCP’s is the port’s. The ping’s ICMP is the layer 3’s, and the curl’s TCP is the layer 4’s. The two are the different, and the different is the diagnostic.
The alternative tools
The alternative tools are the mtr, the tcping, the curl, the nc, and the nmap. The five are the common, and the common is the diagnosis.
The mtr. The mtr combines the ping and the traceroute, and the output is the live’s.
mtr example.com
# My traceroute [v0.95]
# host (192.168.1.100) -> example.com (93.184.216.34)
# Keys: Help Display mode Restart statistics Order of fields quit
# Packets Pings
# Host Loss% Snt Last Avg Best Wrst StDev
# 1. _gateway 0.0% 10 0.5 0.5 0.4 0.6 0.1
# 2. 10.0.0.1 0.0% 10 2.3 2.3 2.2 2.4 0.1
# 3. 93.184.216.34 0.0% 10 12.3 12.3 12.2 12.4 0.1The mtr is the live’s, and the output is the per-hop’s. The Loss% is the loss’s, and the Avg is the average’s. The two are the pair, and the pair is the live’s.
Why the mtr matters. The mtr is the live’s, and the live’s is the continuous. The mtr‘s output is the per-hop’s, and the per-hop’s is the loss’s. The two are the pair, and the pair is the diagnostic.
The tcping. The tcping tests the TCP’s port, and the port’s is the specific’s.
tcping example.com 443
# example.com port 443 openThe tcping example.com 443 is the port’s, and the port’s is the specific’s. The two are the pair, and the pair is the TCP’s.
Why the tcping matters. The tcping is the TCP’s, and the TCP’s is the port’s. The ICMP’s ping is the layer 3’s, and the TCP’s is the layer 4’s. The two are the different, and the different is the diagnostic.
The curl. The curl -I tests the HTTP’s, and the HTTP’s is the application’s.
curl -I https://example.com
# HTTP/2 200
# content-type: text/htmlThe curl -I is the HTTP’s, and the HTTP’s is the application’s. The two are the pair, and the pair is the end-to-end’s.
Why the curl matters. The curl is the application’s, and the application’s is the end-to-end’s. The ping is the ICMP’s, and the ICMP’s is the layer 3’s. The two are the different, and the different is the diagnostic.
The nc. The nc tests the TCP’s or the UDP’s, and the port’s is the specific’s.
nc -zv example.com 443
# Connection to example.com 443 port [tcp/https] succeeded!The nc -zv is the port’s, and the port’s is the specific’s. The two are the pair, and the pair is the TCP’s.
Why the nc matters. The nc is the port’s, and the port’s is the specific’s. The nc‘s -z is the zero-I/O’s, and the zero-I/O’s is the scan’s. The two are the pair, and the pair is the diagnostic.
The nmap. The nmap scans the ports, and the ports are the list’s.
nmap -p 80,443 example.com
# PORT STATE SERVICE
# 80/tcp open http
# 443/tcp open httpsThe nmap -p 80,443 is the ports’, and the ports’ is the list’s. The two are the pair, and the pair is the scan’s.
Why the nmap matters. The nmap is the scan’s, and the scan’s is the port’s. The nmap is the security’s, and the security’s is the audit’s. The two are the pair, and the pair is the diagnostic.
Why the alternatives matter. The alternatives are the TCP’s, the HTTP’s, the port’s. The ping‘s ICMP is the layer 3’s, and the alternatives are the layer 4’s and the layer 7’s. The two are the different, and the different is the complete.
The systematic’s diagnosis
The systematic’s diagnosis is the layered, and the layered is the order’s. The steps are the interface, the route, the gateway, the DNS, the ICMP, the TCP, the application.
The step 1: the interface. The ip addr is the check, and the check is the address’s.
ip addr show eth0The ip addr show eth0 is the address’s, and the address’s is the interface’s. The two are the pair, and the pair is the first’s.
Why the step 1 matters. The step 1 is the interface’s, and the interface’s is the foundation’s. The address’s is the missing, and the missing is the first’s. The two are the pair, and the pair is the diagnosis.
The step 2: the route. The ip route is the check, and the check is the default’s.
ip routeThe ip route is the route’s, and the route’s is the default’s. The two are the pair, and the pair is the second’s.
Why the step 2 matters. The step 2 is the route’s, and the route’s is the gateway’s. The default’s is the missing, and the missing is the route’s. The two are the pair, and the pair is the diagnosis.
The step 3: the gateway. The ping <gateway> is the check, and the check is the local’s.
ping -c 2 192.168.1.1The ping -c 2 192.168.1.1 is the gateway’s, and the gateway’s is the local’s. The two are the pair, and the pair is the third’s.
Why the step 3 matters. The step 3 is the gateway’s, and the gateway’s is the local’s. The local’s is the failure’s, and the failure’s is the cable’s or the switch’s. The two are the pair, and the pair is the diagnosis.
The step 4: the public’s IP. The ping -c 2 8.8.8.8 is the check, and the check is the internet’s.
ping -c 2 8.8.8.8The ping -c 2 8.8.8.8 is the public’s, and the public’s is the internet’s. The two are the pair, and the pair is the fourth’s.
Why the step 4 matters. The step 4 is the public’s, and the public’s is the internet’s. The internet’s is the failure’s, and the failure’s is the ISP’s or the firewall’s. The two are the pair, and the pair is the diagnosis.
The step 5: the DNS. The dig example.com is the check, and the check is the DNS’s.
dig example.comThe dig example.com is the DNS’s, and the DNS’s is the name’s. The two are the pair, and the pair is the fifth’s.
Why the step 5 matters. The step 5 is the DNS’s, and the DNS’s is the name’s. The name’s is the failure’s, and the failure’s is the resolver’s. The two are the pair, and the pair is the diagnosis.
The step 6: the ICMP. The ping example.com is the check, and the check is the name’s and the ICMP’s.
ping -c 2 example.comThe ping -c 2 example.com is the name’s, and the name’s is the ICMP’s. The two are the pair, and the pair is the sixth’s.
Why the step 6 matters. The step 6 is the name’s, and the name’s is the ICMP’s. The ICMP’s is the failure’s, and the failure’s is the firewall’s. The two are the pair, and the pair is the diagnosis.
The step 7: the TCP. The curl -I or the nc -zv is the check, and the check is the port’s.
curl -I https://example.com
nc -zv example.com 443The curl -I and the nc -zv are the port’s, and the port’s is the TCP’s. The two are the pair, and the pair is the seventh’s.
Why the step 7 matters. The step 7 is the port’s, and the port’s is the TCP’s. The TCP’s is the failure’s, and the failure’s is the service’s or the firewall’s. The two are the pair, and the pair is the diagnosis.
Why the systematic matters. The systematic is the layered, and the layered is the order’s. The seven are the steps, and the steps are the diagnosis. The two are the pair, and the pair is the discipline.
Complete Example Session
# ============================================
# PART 1: THE BASIC PING
# ============================================
ping -c 4 8.8.8.8
# PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
# 64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=12.3 ms
# 64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=11.9 ms
# --- 8.8.8.8 ping statistics ---
# 4 packets transmitted, 4 received, 0% packet loss, time 3004ms
# rtt min/avg/max/mdev = 12.100/12.250/12.400/0.115 ms
# ============================================
# PART 2: THE PING BY NAME
# ============================================
ping -c 4 example.com
# PING example.com (93.184.216.34) 56(84) bytes of data.
# 64 bytes from 93.184.216.34: icmp_seq=1 ttl=56 time=12.3 ms
# ============================================
# PART 3: THE PING'S OPTIONS
# ============================================
ping -c 1 -W 2 192.168.1.1 # the one packet, the two seconds
ping -I eth0 8.8.8.8 # the specific interface
ping -4 example.com # the IPv4
ping -6 example.com # the IPv6
# ============================================
# PART 4: THE TRACEROUTE
# ============================================
traceroute example.com
# traceroute to example.com (93.184.216.34), 30 hops max, 60 byte packets
# 1 _gateway (192.168.1.1) 0.512 ms 0.489 ms 0.475 ms
# 2 10.0.0.1 (10.0.0.1) 2.345 ms 2.312 ms 2.298 ms
# 3 * * *
# 4 93.184.216.34 (93.184.216.34) 12.345 ms
# ============================================
# PART 5: THE TRACEROUTE'S OPTIONS
# ============================================
traceroute -n example.com # the no-DNS's
traceroute -I example.com # the ICMP's
traceroute -T example.com # the TCP's
traceroute -m 64 example.com # the 64 hops
traceroute -q 1 example.com # the one query
traceroute -w 2 example.com # the two seconds
# ============================================
# PART 6: THE MTR
# ============================================
mtr example.com
# My traceroute [v0.95]
# host (192.168.1.100) -> example.com (93.184.216.34)
# Packets Pings
# Host Loss% Snt Last Avg Best Wrst StDev
# 1. _gateway 0.0% 10 0.5 0.5 0.4 0.6 0.1
# 2. 10.0.0.1 0.0% 10 2.3 2.3 2.2 2.4 0.1
# 3. 93.184.216.34 0.0% 10 12.3 12.3 12.2 12.4 0.1
# ============================================
# PART 7: THE FAILURE MODES
# ============================================
ping example.com
# From 192.168.1.1 icmp_seq=1 Destination Host Unreachable
ping 8.8.8.8
# connect: Network is unreachable
ping example.invalid
# ping: example.invalid: Name or service not known
ping -c 4 8.8.8.8
# 4 packets transmitted, 0 received, 100% packet loss
# ============================================
# PART 8: THE TCP'S TEST
# ============================================
curl -I https://example.com
# HTTP/2 200
nc -zv example.com 443
# Connection to example.com 443 port [tcp/https] succeeded!
nmap -p 80,443 example.com
# PORT STATE SERVICE
# 80/tcp open http
# 443/tcp open https
# ============================================
# PART 9: THE SYSTEMATIC'S DIAGNOSIS
# ============================================
# 1. ip addr show eth0
# 2. ip route
# 3. ping -c 2 192.168.1.1
# 4. ping -c 2 8.8.8.8
# 5. dig example.com
# 6. ping -c 2 example.com
# 7. curl -I https://example.com
# ============================================
# PART 10: WHAT NOT TO DO
# ============================================
# Don't assume the ping's failure is the host's down
# The ICMP's block is the firewall's. // ⚠️
# Don't forget the TCP's test
# The ICMP's block is the false's negative. // ⚠️
# Don't ignore the `* * *`
# The hop may block the ICMP, and the later's hop may respond.│# ⚠️
# Don't use the traceroute's UDP without the check
# The firewall can block the UDP. // ⚠️
# Don't forget the family's test
# The IPv4 and the IPv6 are the separate. // ⚠️
# Don't skip the systematic's steps
# The layered is the fast's. // ⚠️The ten parts cover the basic ping, the ping by name, the ping’s options, the traceroute, the traceroute’s options, the mtr, the failure modes, the TCP’s test, the systematic’s diagnosis, and the anti-patterns.
Quick Reference
The ping‘s Options
| The option | The purpose |
|---|---|
The -c N | The N packets |
The -W N | The N seconds’ timeout |
The -I eth0 | The interface’s |
The -4 | The IPv4 |
The -6 | The IPv6 |
The -s N | The N bytes’ size |
The -q | The quiet’s |
The traceroute‘s Options
| The option | The purpose |
|---|---|
The -n | The no-DNS’s |
The -I | The ICMP’s |
The -T | The TCP’s |
The -m N | The N hops’ max |
The -q N | The N queries’ |
The -w N | The N seconds’ |
The Failure Messages
| The message | The cause |
|---|---|
The Destination Host Unreachable | The host’s down or the route’s missing |
The Network is unreachable | The route’s missing |
The Name or service not known | The DNS’s failure |
The 100% packet loss | The host’s down or the ICMP’s blocked |
The Alternative Tools
| The tool | The purpose |
|---|---|
The mtr | The live’s ping + traceroute |
The tcping | The TCP’s port |
The curl -I | The HTTP’s |
The nc -zv | The TCP’s port |
The nmap | The ports’ scan |
The Systematic’s Steps
| The step | The command |
|---|---|
| 1. The interface | ip addr |
| 2. The route | ip route |
| 3. The gateway | ping <gateway> |
| 4. The public’s | ping 8.8.8.8 |
| 5. The DNS | dig example.com |
| 6. The ICMP | ping example.com |
| 7. The TCP | curl -I |
The ICMP’s Types
| The type | The purpose |
|---|---|
| The 0 | The echo reply |
| The 3 | The destination unreachable |
| The 8 | The echo request |
| The 11 | The time exceeded |
Best Practices
✅ Do This:
# Use the -c for the bounded
ping -c 4 8.8.8.8 # ✅
# Use the -I for the specific interface
ping -I eth0 8.8.8.8 # ✅
# Use the -n for the fast traceroute
traceroute -n example.com # ✅
# Use the mtr for the live
mtr example.com # ✅
# Use the curl for the TCP's test
curl -I https://example.com # ✅
# Test the gateway first
ping -c 2 192.168.1.1 # ✅
# Test the public's IP
ping -c 2 8.8.8.8 # ✅
# Test the DNS
dig example.com # ✅❌ Don’t Do This:
# Don't assume the ping's failure is the host's down
ping example.com # the ICMP's block is the firewall's // ⚠️
# Don't forget the TCP's test
# The ICMP's block is the false's negative. // ⚠️
# Don't ignore the `* * *`
# The hop may block the ICMP. // ⚠️
# Don't use the traceroute's UDP without the check
traceroute example.com # the firewall can block the UDP // ⚠️
# Don't forget the family's test
# The IPv4 and the IPv6 are the separate. // ⚠️
# Don't skip the systematic's steps
# The layered is the fast's. // ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
| The ping’s failure | The false’s negative | The TCP’s test |
The * * * | The blocked’s | The later’s hop |
| The UDP’s block | The traceroute’s fail | The -I or the -T |
| The DNS’s failure | The name’s | The dig |
| The wrong interface | The no-reply | The -I |
| The family’s | The separate | The -4 or the -6 |
| The missing route | The unreachable | The ip route |
| The firewall’s block | The no-response | The alternative |
Real-World Examples
1. The basic ping
ping -c 4 8.8.8.82. The ping by name
ping -c 4 example.com3. The specific interface
ping -I eth0 8.8.8.84. The basic traceroute
traceroute example.com5. The no-DNS’s
traceroute -n example.com6. The mtr
mtr example.com7. The TCP’s test
curl -I https://example.com8. The port’s test
nc -zv example.com 4439. The gateway’s test
ping -c 2 192.168.1.110. The DNS’s test
dig example.comVisual: The ICMP’s Flow
┌──────────────────────────────────────────────────────────┐
│ THE HOST │
│ │ │
│ │ The ICMP echo request (the type 8) │
│ ▼ │
│ THE ROUTE │
│ │ │
│ │ The forward │
│ ▼ │
│ THE TARGET │
│ │ │
│ │ The ICMP echo reply (the type 0) │
│ ▼ │
│ THE HOST │
│ │
│ The round-trip's time is the latency's, and the │
│ loss's percentage is the reliability's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Traceroute
┌──────────────────────────────────────────────────────────┐
│ THE TTL = 1 │
│ The host ──► the first hop ──► the "time exceeded" │
│ │
│ THE TTL = 2 │
│ The host ──► the first hop ──► the second hop ──► the "time exceeded"│
│ │
│ THE TTL = 3 │
│ The host ──► the first ──► the second ──► the third ──► the "time exceeded"│
│ │
│ ... │
│ │
│ THE TTL = N │
│ The host ──► ... ──► the destination ──► the echo reply│
│ │
│ The increasing TTL reveals the path's hops. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Failure Modes
┌──────────────────────────────────────────────────────────┐
│ THE "Destination Host Unreachable" │
│ The gateway's report. │
│ The host is the down, or the route is the missing. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE "Network is unreachable" │
│ The local's report. │
│ The default's route is the missing. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE "Name or service not known" │
│ The DNS's failure. │
│ The name's resolution is the failed. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE "100% packet loss" │
│ The summary's. │
│ The host is the down, or the ICMP is the blocked. │
│ │
│ The ping's failure is not always the host's down. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Systematic’s Diagnosis
┌──────────────────────────────────────────────────────────┐
│ 1. ip addr show eth0 │
│ The interface's address. │
│ │
│ 2. ip route │
│ The route's table. │
│ │
│ 3. ping -c 2 192.168.1.1 │
│ The gateway's reachability. │
│ │
│ 4. ping -c 2 8.8.8.8 │
│ The internet's reachability. │
│ │
│ 5. dig example.com │
│ The DNS's resolution. │
│ │
│ 6. ping -c 2 example.com │
│ The name's and the ICMP's. │
│ │
│ 7. curl -I https://example.com │
│ The TCP's and the HTTP's. │
│ │
│ The layered is the fast's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The mtr
┌──────────────────────────────────────────────────────────┐
│ My traceroute [v0.95] │
│ host (192.168.1.100) -> example.com (93.184.216.34) │
│ Packets Pings │
│ Host Loss% Snt Last Avg Best Wrst StDev│
│ 1. _gateway 0.0% 10 0.5 0.5 0.4 0.6 0.1│
│ 2. 10.0.0.1 0.0% 10 2.3 2.3 2.2 2.4 0.1│
│ 3. 93.184.216.34 0.0% 10 12.3 12.3 12.2 12.4 0.1│
│ │
│ The live's per-hop's statistics. │
│ The Loss% is the loss's, and the Avg is the average's. │
│ │
└──────────────────────────────────────────────────────────┘Summary
| The command | The purpose |
|---|---|
The ping | The ICMP’s reachability |
The traceroute | The path’s hops |
The mtr | The live’s both |
The curl -I | The HTTP’s |
The nc -zv | The TCP’s port |
The nmap | The ports’ scan |
The dig | The DNS’s |
The ip addr | The interface’s |
The ip route | The route’s |
| The failure | The cause |
|---|---|
The Destination Host Unreachable | The host’s down |
The Network is unreachable | The route’s missing |
The Name or service not known | The DNS’s |
The 100% packet loss | The host’s down or the ICMP’s block |
Key takeaways:
- The
pingsends the ICMP echo request and waits for the echo reply — the round-trip’s time is the latency’s, and the packet loss’s percentage is the reliability’s - The
traceroutesends the packets with the increasing TTL — each hop returns the “time exceeded” message, and the hops reveal the path - The ICMP’s block is the false’s negative — a failed ping does not always mean the host is down, and the TCP’s test is the alternative
- The
mtrcombines the two and shows the live’s statistics — theLoss%and theAvgare the per-hop’s - The failure messages are the specific — the “Destination Host Unreachable”, the “Network is unreachable”, the “Name or service not known”, and the “100% packet loss” each have the cause
- The
curland thenctest the TCP’s ports — the ICMP’s ping is the layer 3’s, and the TCP’s is the layer 4’s - The systematic’s diagnosis is the seven steps — the interface, the route, the gateway, the public, the DNS, the ICMP, the TCP
- The gateway’s ping tests the local’s network — the public’s ping tests the internet’s
- The DNS’s test is the
dig— the name’s resolution is the separate from the reachability’s - The two pings are the diagnosis — the gateway’s and the public’s, and the two together isolate the failure
Remember: The ping and the traceroute are the reachability’s and the path’s. The ping‘s success is the ICMP’s, and the traceroute‘s output is the hops’. The ICMP’s block is the false’s negative, and the TCP’s test is the alternative. The mtr is the live’s, and the curl is the TCP’s. The systematic’s seven steps are the diagnosis, and the layered is the fast’s. The connectivity’s testing is the discipline, and the discipline is the skill.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!