Verifying Connectivity
Once network parameters are configured, you must verify the configuration is correct. ping and traceroute are the two most widely used utilities. The network in Figure 4-16 will be used throughout this section to illustrate tools commonly used to verify connectivity and their use.
)
FIGURE 4-16 Verifying Connectivity
Ping
The first application to use when verifying connectivity is ping. The ping application sends a series of ICMP packets, called the ICMP echo request, to the indicated IP address. The host should respond with an ICMP echo reply packet if it receives these packets.
For instance, you could verify connectivity from host A in the network illustrated in Figure 4-16 by
Pinging B’s interface address, verifying local connectivity on the segment is working correctly.
Pinging the interface address of C1, verifying connectivity to the default gateway is working correctly.
Pinging the interface address of C2, verifying connectivity to the default gateway and the default gateway is configured correctly to route packets back to A.
Pinging the interface address of E to verify connectivity is working across the entire network (or Internet) to the destination host.
You can also ping local broadcast and multicast addresses. For instance, pinging 203.0.113.255 (the network broadcast address) should elicit a response from every device connected to the segment. If you ping 203.0.113.255 from A, you should receive replies from B and C. Pinging a broadcast or multicast address can be especially useful to clear and rebuild a host’s IPv4 ARP cache and IPv6 neighbor table.
Ping is a versatile application with many options. Options for the ping application on Ubuntu Linux include
-4: Use IPv4 packets only.
-6: Use IPv6 packets only.
-b: Allow pinging to a broadcast address (as described previously).
-c: Send a specific number of ICMP echo packets; the default usually is 5 or 10 for most ping applications.
-f: Flood ping, which provides a quick way to determine how many packets are being dropped between the source and destination.
-i: Use a specific source address or interface.
-p: “Pad” the ICMP echo packets with a specific pattern. This can be good for catching problems with the network transmitting packets of all 1s, all 0s, or some other specific content.
-s: Pad the ICMP packets transmitted to a specific size; this can be good for determining if larger or smaller packets can be carried through the network.
-t: Set the TTL to a specific number.
The source interface can be handy when verifying local connectivity if you cannot access a specific host. If you have access to router C but not to host B, you can ping B from C twice, using
A source address of interface C1
A source address of interface C2
If host B answers the ping sourced from C1 but not C2, the likely problem is B’s default gateway configuration.
Traceroute
Traceroute is another helpful piece of network diagnostics software installed on most hosts. Traceroute takes advantage of the TTL in each IP packet to find the path between the local host and a destination.
If you run a traceroute from host A in Figure 4-16 toward E:
The traceroute application at A will send an IP packet with a TTL of 1 and E’s destination address.
Router C will receive this packet, decrement the TTL, discard the packet, and send an ICMP TTL expired response to A.
The traceroute application at A has now discovered the first hop, or the first router on the path to E is C.
The traceroute application at A will send an IP packet with a TTL of 2 and E’s destination address.
Router C will receive this packet, decrement the TTL to 1, and forward the packet to D.
Router D will receive the packet, decrement the TTL to 0, discard the packet, and send an ICMP TTL expired response to A.
The traceroute application at A has now discovered the second hop, or the second router on the path to E is D.
The traceroute application at A will send an IP packet with a TTL of 3 and E’s destination address.
Router C will receive this packet, decrement the TTL to 2, and forward the packet to D.
Router D will receive this packet, decrement the TTL to 1, and forward the packet to E.
Host E will receive this packet, decrement the TTL to 0, discard the packet, and send an ICMP TTL expired response to A.
Because the traceroute application at A now has a response from the destination IP address, it will stop sending packets.
Figure 4-17 shows a typical traceroute output.
)
FIGURE 4-17 Typical Traceroute Output
If you traceroute to a domain name (such as rule11.tech), most applications will resolve the name into a destination IP address.
Each output line describes a set of packets transmitted at the TTL indicated. Line 1 represents three packets sent with a TTL of 1; line 2 represents three packets sent with a TTL of 2, etc. Traceroute keeps track of how much time elapses between sending the packet and receiving an ICMP TTL expired response.
The address given for each device is generally (but not always) the interface address closest to the source of the traceroute packets. In Figure 4-17, if A sent a traceroute to host E, router C would respond from interface C1’s address, and router D would respond from interface D1’s address. It is important to remember you are not seeing the entire path in traceroute results; you cannot see the outbound interface from each device forwarding the packet.
An asterisk in the output, such as those shown in Figure 4-17, can mean one of several things:
The device 13 hops away from the local host is configured not to send ICMP TTL expired replies.
Some device between the local host and the device 13 hops away is configured to filter or block ICMP TTL expired replies.
Hosts sometimes do not send ICMP replies, and network operators sometimes block ICMP replies to improve network security.
Traceroute implementations vary in the kind of packet they send to discover the path. For instance, Windows sends ICMP echo request packets with various TTL settings to perform a traceroute, while most Linux implementations and Apple Macintosh macOS send User Datagram Protocol (UDP) packets.
Traceroute does not always detail the path from a host to a destination; Figure 4-18 illustrates.
)
FIGURE 4-18 Traceroute and Tunnels
In Figure 4-18, routers B and D are connected by a tunnel:
Router B encapsulates packets inside a second header with interface D1’s address as the destination.
When router D receives these packets, it removes the outer header and forwards them based on the inner header toward host E.
Because router C only receives a packet with a destination address of interface D1, it does not examine the internal packet nor process it in any other way; it just receives the packet. It forwards it to router D. This means router C will not decrement the TTL in the original packet transmitted by host A nor respond.
Router C will not be in the traceroute results from host A to E in this situation.