Ping Tutorial Ping is used to test TCP/IP connectivity on your own and on remote Pcs in other networks (over

r the internet). Ping sends a ICMP echo packet to another host on the network which triggers another ICMP echo reply thats send to your computer, probably through a router or several routers (hops) (if the destination is located far away in another network). Usually only three packets are send by default. If you need help which switch to use, type in ping help or ping /? (on windows) Default use of ping is: ping www.google.com you can even omit the www: ping google.de To increase or decrease the number of packets used type : ping -n 2 www.google.com (this pings google 2 times. You can type -n 16 which would ping google 16 times and so on.) (this just pings one google server three times)

To ping a host again and again and again until you stop it by pressing STRG+C type: ping -t www.google.com You can ping any host on your network, for example: ping 192.168.90.110 ping -f www.google.com (this pings a host with the IP adress of 192.168.90.110 if this IP exists on your LAN) (this will make sure that the packets wont be fragmented (split into parts) by setting the so-called DF bit (Dont fragment-bit). This is usually used with o switches such as -l, to set another buffer size)

Ping output is not hard to understand: time=31ms The round trip time (RTT) measures the time it takes to send the packet to the destination host and receive the ICMP replay packet. So the path from A to B and from B back to A. The average time RTT is calculated for the ping output, you can see it on the bottom of the results. Important note: The RTT can be distorted by assymmetric routing and by certain other factors such as that TCP is given preference over ICMP traffic. Also RTT can be slightly skewed by the CPU processing time and workload. TTL=45 The time to live (TTL) measures the amount of hops (routers) the packets pass before reaching their destination. So the TTL starts with 255 and is then decreased one by one until reaching the

destination. Important to note is that the TTL is not only decreased by the routers but also by machines. Windows puts the TTL to 128 and Linux machines usually reduce it by 192. The maximum TTL is 255, as the IP Header field is 8 Bits. As you know the ICMP packets is encapsulated by IP and is considered part of IP. The 8 Bits octet can have 256 different states. So the maximum number is 255 since you start at zero. If a Ping packet is send it will be decreased one by one by the router along its path and eventually also decreased by a specific value by another machine whatever system it is running. So the TTL could be calculated as 255 192 -14 = 49. 255 as default value, 192 by the host and 14 routers that need to be subtract. To find out the default TTL for your windows machine, type: ping loopback (Instead of loopback you can write localhost our 127.0.0.1 or anything in the range of 127.0.0.1 to 127.255.255.254 to reach your virtual loopback address)

Note that Windows 7 by default displays the Ipv6 Output, which does not show the TTL value. To see it use : ping loopback -4 (This will display the Ipv4 Output with the TTL default value)

Bytes=32 How many bytes are sent. The IP payload is filled with ASCII characters to reach the specified number of bytes.The MTU (Maximum Transmission Unit) plays an important role here. By default ping sends 32 bytes-filled IP packets. You can send up to 65,536 bytes. According to the MTU of Ethernet which is 1500 Bytes, a packet as large as 65,500 Bytes will be split into parts, it will be fragmented. Its interesting to play around with that in your own home made LAN. Since the MTU is 1500, the specified MTU for ICMP is 1472. 1500 minus the size of the IP Header (20 Bytes for IPv4) and minus the size of the ICMP header (8 Bytes for ICMPv4). So you can type the following : ping -l 1472 192.168.10.10 (assume 192.168.10.10 is your router. Type the IP of your own router or of any host in your LAN)

32 Bytes is normally used but here you changed the buffer to 1472 Bytes, which is exactly the allowed MTU for ICMP that can be sent without fragmentation. Ping -l 1473 192.168.10.10 (this will sent packets of 1473 Bytes to the host 192.168.10.10)

Since this exceeds the allowed MTU value by one Byte the packet will be fragmented. If you type this, then the packet will not be fragmented and you get an error message: ping -l 1473 -f 192.168.10.10 Error message: Packet needs to be fragmented but DF set. The DF-bit forbids a fragmentation of the IP packet. But the packets need to be fragmented since (see above: the -f switch sets the DF-bit)

the size exceeds the MTU for ICMP. For MTU see here : http://www.scribd.com/doc/76336612/Maximum-Transmission-Unit-MTU-short-explanation http://en.wikipedia.org/wiki/Maximum_transmission_unit Furthermore you can redirect the ping output into a text file, by typing this: ping google.com > ping_output.txt (The output for google.com will be put into a text file called ping_output.txt)