___________________________________________________________________
Ping Un-Pinged By Ankit Fadia mailto:nkit@bol.net.in
___________________________________________________________________
Ping is an extremely popular diagnosis tool, which is commonly used to determine whether a remote host is alive, or not. This manual explores this popular TCP/IP diagnosis utility in detail.
The word ‘ping’ is actually taken from a scientific operation carried out to locate objects using sonar. That is exactly what ‘ping’ does in networks, finding or determining whether a particular host is alive or not.
Whenever one cannot make a connection to a particular port of a remote system, then ‘ping’ is the starting point to determine whether the remote system that is being tried to open a connection with is connected to the Internet or not, or in other words whether it is alive or not. Similarly, when you use ‘ping’ and determine that a remote system is not alive, then it would mean that you cannot make a connection to it.
So, basically ‘ping’ is used to determine whether a remote host is alive or not or whether it is connected to the Internet or not.
*****************
HACKING TRUTH: Although the implications of the results of ‘ping’ can best be described as the above, they do not always hold true. Nowadays, with the increased usage of firewalls, router access lists and other access controls, it doesn’t always mean that if you cannot ‘ping’ a particular host, then you cannot telnet to a particular port on it.
*****************
Note: It is recommended that before you go on, you read the ICMP section in the following manual: http://hackingtruths.box.sk/traceroute.htm
What ping does is that it sends an ICMP ‘echo request’ message to a host, expecting an ICMP ‘echo reply’ to be returned. An ICMP ‘echo request’ message would have a type value of 8 and a code value of 0. On the other hand, an ICMP ‘echo reply’ message would have a type value of 0 and a code value of 0.
Wherever a host receives an ICMP echo request message, then its kernel knows that it has to reply to this request message with an ICMP echo reply message. So in other words we can also call an echo message a ‘ping request’ message and an echo reply message as the ‘Ping reply’ message.
The format of an ICMP ‘echo request’ and ‘echo reply’ message would be as follows:
0 7 8 15 16 31
____________________________________________________________________
| | | |
| Type (0 or 8) | Code (0) | 16-Bit Checksum |
| | | |
|_____________ |____________________ |_________________________________|
| | |
| Identifier | sequence number |
|__________________________________|_________________________________|
| |
| |
| (Optional Data) |
| |
|___________________________________________________________________ |
Whenever the host receives an ICMP request message, then it is supposed to echo back the identifier and sequence number fields. Also the data contained in the Optional Data field has got to be echoed. On most Unix systems, the identifier field is set to the Process ID of the sending process. This is done so that ‘ping’ can differentiate between multiple instances of ping running on the same system.
The sequence number field by default has the value 0. This value is then incremented every time a new echo request is sent. Ping prints the sequence number of each returned packet, allowing us to see if packets are missing, reordered or duplicate.
For details about what the other fields contain, read the following manual: http://hackingtruths.box.sk/traceroute.htm
So the basic mechanism of ping can be described as below: The client system sends an echo request ICMP message to the remote host. The remote host on receiving such a request packet is supposed to reply with the echo reply ICMP message. If the client receives such an echo reply message from the remote host, then it prints ‘Host Alive’ in the output. Else if the client does not receive the echo reply message from the host, then it says ‘No Answer’ in the output.
Let us take an example to learn what exactly the output displayed by ping tells us:
# ping hackingtruths.box.sk
Pinging hackingtruths.box.sk [194.x.yyy.227] with 32 bytes of data:
32 bytes from 194.x.yyy.227: icmp_seq=0 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=1 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=2 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=3 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=4 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=5 ttl=225 time=0 ms
32 bytes from 194.x.yyy.227: icmp_seq=6 ttl=225 time=0 ms
……..
The first line of the output shows that ping first resolves the hostname supplied to it into its corresponding hostname. You will also find that when the ICMP echo reply is returned, the sequence number is printed, followed by the TTL and finally the round trip time is printed. In other above example, the echo replies were received in the correct order i.e. 1, 2, 3,4 and so on. Ping is able to calculate the round trip time by storing the time at which it sends the echo request in the data portion of the ICMP message. When the reply in returned it subtracts this value from the current time.
CPing is a freeware MFC class to implement ping functionality. You can download the header files, the Documentation and help files from here: Click Here To Download
That is all for know, hope you liked this manual. Till the next update, this is Ankit Fadia saying goodbye!!!
Ankit Fadia
To receive tutorials written by Ankit Fadia on Everything you ever dreamt of in your Inbox, join his mailing list by sending a blank email to: programmingforhackers-subscribe@egroups.com