How ping works

The basic ping command syntax is "ping hostname". For example, "ping ipBalance.com" from DOS prompt and the output might look like:

C:\Documents and Settings\DOS>ping www.ipBalance.com

Pinging www.ipBalance.com [71.18.254.xxx] with 32 bytes of data:

Reply from 71.18.254.xxx: bytes=32 time=49ms TTL=49
Reply from 71.18.254.xxx: bytes=32 time=49ms TTL=49
Reply from 71.18.254.xxx: bytes=32 time=49ms TTL=48
Reply from 71.18.254.xxx: bytes=32 time=49ms TTL=48

Ping statistics for 71.18.254.xxx:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 49ms, Maximum = 49ms, Average = 49ms

C:\Documents and Settings\DOS>


If ICMP is blocked by network admin, you will se below.

C:\Documents and Settings\DOS>ping www.ipBalance.com

Pinging www.ipBalance.com [71.18.254.xxx] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 71.18.254.xxx:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

TTL reply

Ping sends an ICMP echo request packet that ICMP type is 8, code 0. (with the TTL value, default 128) . Ping expects back an ICMP ‘echo reply’ packet that ICMP type is 0. The round trip time is displayed in millisecond.

TTL Expired in Transit/TTL Time exceed

Most devices initialize 128 or higher TTL value of outgoing IP Packets. Outside of devices that are far away than TTL hop, those devices are not able to communicate with origin.
For example, if you are 17 hops away from website www.ipBalance.com, set TTL 12 when you ping out to the site. the IP Packets will not reach the site. B/C TTL will be ‘expire in transmit’ before they reach the site.
Simply, you can tested it. Do traceroute to www.yahoo.com from your dos prompt.

 

C:\Documents and Settings\chris.yoon> tracert www.yahoo.com

Tracing route to www.yahoo-ht3.akadns.net [69.147.114.210]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms asqlr90-vlan215.mcil.com [154.139.198.130]
2 <1 ms <1 ms <1 ms asqlr1-vlan64.mscil.com [154.139.254.141]
3 <1 ms <1 ms <1 ms asqar1-vlan30.mscil.com [154.139.255.1]
4 <1 ms <1 ms <1 ms asqir2-vlan49.mscil.com [166.141.0.39]
5 <1 ms <1 ms <1 ms asqir1-vlan22.mscilink.com [192.135.72.201]
6 <1 ms <1 ms <1 ms GigiEthernet1-0.ALT.NET [137.39.253.177]
7 <1 ms <1 ms <1 ms 169.at-6-0-0.ALT.NET [152.163.34.182]
8 3 ms 3 ms 3 ms 0.so-0-0-0.ALT.NET [152.163.136.209]
9 4 ms 3 ms 3 ms 0.ge-7-1-0.ALT.NET [152.163.141.161]
10 4 ms 4 ms 4 ms telia-gw.n54ny.ip.att.net [192.205.32.49]
11 5 ms 5 ms 5 ms tbr1.wswdc.ip.att.net [12.123.8.98]
12 5 ms 4 ms 4 ms 12.122.113.17
13 5 ms 5 ms 5 ms 12.86.111.22
14 6 ms 6 ms 6 ms ge-3-1-0-p170.msr2.re1.yahoo.com [216.115.108.69
]
15 5 ms 5 ms 6 ms gi1-23.bas-a2.re3.yahoo.com [66.196.112.55]
16 5 ms 5 ms 5 ms f1.www.vip.re3.yahoo.com [69.147.114.210]

Trace complete.

 

Total 16 hop to reach www.yahoo.com.
From DOS prompt, type ping -i 5 www.yahoo.com (it manually set TTL 5 on ICMP packet)

C:\Documents and Settings\DOS>ping -i 5 www.yahoo.com

Pinging www.yahoo-ht3.akadns.net [209.191.93.52] with 32 bytes of data:

Reply from 192.135.72.201: TTL expired in transit.
Reply from 192.135.72.201: TTL expired in transit.
Reply from 192.135.72.201: TTL expired in transit.
Reply from 192.135.72.201: TTL expired in transit.

Ping statistics for 209.191.93.52:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\DOS>

As you can see above result, hop 5 192.135.72.201 device is responsed to you. Of cause TTL expired in transit, b/c 192.135.72.201 is not final destination. So won’t get echo reply.

How to Discover your TTL on your device

To discover the default TTL value of your device, ‘ping localhost’ and examine the TTL reply value. For older Windows machines this value is 32. For newer Windows machines, this value is 128.


C:\Documents and Settings\DOS>ping localhost

Pinging localhost [127.0.0.1] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

 

The table below lists possible ICMP-type values.

ICMP Type Literal
0 echo-reply
3 destination unreachable
code 0 = net unreachable
code 1 = host unreachable
code 2 = protocol unreachable
code 3 = port unreachable
code 4 = fragmentation needed and DF set
code 5 = source route failed
4 source-quench
5 redirect code 0 = redirect datagrams for the network
code 1 = redirect datagrams for the host
code 2 = redirect datagrams for the type code of service and network
code 3 = redirect datagrams for the type of service and host
6 alternate-address
8 echo
9 router-advertisement
10 router-solicitation
11 time-exceeded code 0 = time to live exceeded in transit code 1 = fragment reassembly time exceeded
12 parameter-problem
13 timestamp-request
14 timestamp-reply
15 information-request
16 information-reply
17 mask-request
18 mask-reply
31 conversion-error
32 mobile-redirect

 

The below chart shown possible output characters from the ping :

Character Description
! Each exclamation point indicates receipt of a reply.
. Each period indicates the network server timed out while waiting for a reply.
U A destination unreachable error PDU was received.
Q Source quench (destination too busy).
M Could not fragment.
? Unknown packet type.
& Packet lifetime exceeded.

 

Leave a Reply