7.1 Introduction
"Ping" a name derived from sonar operation. P ing program was written by Mike Muuss, the purpose is to test whether another host is reachable. The program sends an ICMP echo request packet to the host, and waiting for the ICMP echo reply (Figure 6 - 3 lists all the ICMP packet type).
Generally, if not P ing to a host, then it can not or FTP Te lnet that host. Conversely, if you can not Te lnet to a host, you can usually use P ing program to determine where the problem lies. P ing program also measures the round-trip time of this host, to indicate that the host away from us "how far."
In this chapter, we will use the P ing procedures as a diagnostic tool for in-depth analysis ICMP. P ing gave us the opportunity to detect IP record route and timestamp options. Document [Stevens 1990] Chapter 11 provides a source code program P ing.
A few years ago we can make that assertion is not limited, if not P ing to a host, you can not Te lnet or FTP to that host. As I nternet enhance safety awareness, there has been providing access control list of routers and firewalls, it is not limited like this assertion is no longer set up. A host of accessibility may not only depend on whether the IP layer up, also depends on what kind of protocol and port number. P ing procedures of operating results may show a host unreachable, but we can log on to the No. 25 port (mail server) that hosts Te lnet remote use.
7.2 Ping program
We call send echo request ping program for customers, and called the ping of the host server. Most TCP / IP implementations are directly supported in the kernel P ing server - a server is not a user process (two kinds ICMP query services described in Chapter 6, the address mask and timestamp requests, are also directly processed) in the kernel.
ICMP echo request and echo reply message in FIG 7--1 in FIG.
For other types of ICMP query messages, the server must respond identifier and sequence number fields. In addition, the option data sent by the client must echo, assuming that customers are interested in this information will be.
U nix system when the program is to achieve ICMP ping message identifier field set to the ID number of the sending process. Thus even when running on the same host multiple instances simultaneously ping program, the ping program identification information may be returned.
The serial number starts from 0, every transmission of a new echo request is incremented. ping program prints the serial number of each packet is returned, allowing us to see if there is packet loss, out of sequence or repeated. IP is one of the best datagram delivery service, so these three conditions are likely to occur.
Ping older version of the program has been run in this mode, it sends a second echo request, and print out the obvious answer every back to return. However, the new version of the realization of the need to add the - s option to run in this mode. By default, the new versions of the program only sends a ping echo request. If you receive an echo reply, the output "host is alive"; otherwise, within 20 seconds without receiving a reply on the output "no answer (no answer)."
7.2.1 LAN output
The output of ping program running on the LAN has the following general format:
cll@cll-linux:~ $ ping google.com.cn
PING google.com.cn (203.208.40.127) 56(84) bytes of data.
64 bytes from 203.208.40.127: icmp_seq=1 ttl=119 time=3.22 ms
64 bytes from 203.208.40.127: icmp_seq=2 ttl=119 time=1.85 ms
64 bytes from 203.208.40.127: icmp_seq=3 ttl=119 time=2.03 ms
When returning ICMP echo reply, to print out the serial number and TTL, and calculate the round trip time (TTL survival time at IP header field in. The current BSD system ping program each time it receives all print out echo reply TTL- some systems do not receive this. we will introduce the usage of TTL by traceroute program in Chapter 8).
As can be seen from the above output, the echo reply is returned in order of transmission (0,1,2, etc.). ping round trip time by the program to calculate the time value is stored in the transmission request ICMP packet data. When the response is returned, with the current time minus the ICMP packets stored in the time value, which is the round-trip time. Note that, at the transmitting end bsdi to, the results are round-trip time 0 ms. This is the reason for the low because the program uses a timer resolution. BSD / 3 8 6 version 0.9. 4 System can provide several 10 ms timer (described in more detail in Appendix B). In a later section, when the system with higher resolution we will find the timer when viewing the tcpdump output (S un), ICMP echo request and echo response time difference of 4 ms or less.
The first line of output includes the IP address of the destination host, although its name is specified (svr 4). This shows that the name has been converted into an IP address through the parser. We will introduce and DNS resolvers in Chapter 14. Now, we find that, if typing ping command, and after a few seconds will print on line one IP address, DNS is to use this time to determine the host name corresponding to the IP address.
tcpdump output in the present embodiment FIG 7--2 in FIG.
Echo reply is received from the echo request is sent to the time interval is always 3.7 ms. Can also be seen, echo request transmitted about once every 1 second.
Typically, the first a round-trip time value than other big. This is because the destination hardware address is not in the ARP cache sake. As we saw in Chapter 4 that, before sending the first echo request to send an ARP request and ARP reply is received, it takes a few milliseconds. The following example illustrates this point:
cll@cll-linux:~ $ arp -a
? (192.168.4.127) at 00:00:c0:1d:12:6c [ether] on enp0s31f6
? (192.168.166.128) at 00:0c:29:3a:b9:cd [ether] on vmnet8
? (192.168.4.106) at 00:00:c0:1d:8e:8c [ether] on enp0s31f6
? (192.168.4.112) at e4:b9:7a:66:2a:d6 [ether] on enp0s31f6
? (192.168.5.177) at 54:bf:64:9a:71:e9 [ether] on enp0s31f6
? (192.168.4.125) at 8c:ec:4b:e3:b0:a3 [ether] on enp0s31f6
arvinchen.cn.zmt.local (192.168.5.1) at 50:da:00:d8:79:ad [ether] on enp0s31f6
? (192.168.5.91) at 64:00:6a:1d:18:b2 [ether] on enp0s31f6
? (192.168.4.62) at 8c:ec:4b:fd:23:ce [ether] on enp0s31f6
? (192.168.4.101) at 70:b3:d5:5e:23:98 [ether] on enp0s31f6
? (192.168.4.147) at 74:e6:e2:f4:72:a9 [ether] on enp0s31f6
? (192.168.5.137) at d4:81:d7:db:13:e9 [ether] on enp0s31f6
? (192.168.4.77) at 64:00:6a:3d:03:a4 [ether] on enp0s31f6
RT T 1 in the first extra time is 3 ms probably because sending ARP requests and receives the ARP response takes. This example is run on the host sun, it provides a timer with microsecond resolution, but can only print out the ping program millisecond round trip time. In our earlier example running on BSD / 386 version 0.9.4, the round-trip time value is printed 0 ms, because this is only provided 1 0 ms timer error. The following example is BSD / 386 version 1.0 output, it also provides a timer with microsecond resolution, therefore, the output of the ping program also has a higher resolution.
7.2.2 WAN output
In a WAN, the result will be very different. The following examples are the results with normal traffic when the I nternet i.e. a weekday afternoon:
Here, the serial number is 1,2,3,4,6,1 0,11,1 2 and 13 echo request or echo reply was lost somewhere. In addition, we note that round-trip time of great changes have taken place (such as 52% higher packet loss rate is not normal. Even in the afternoon on weekdays, for I nternet is also not normal).
It is also possible to see the duplicate packets over the WAN (i.e. packets of the same sequence number is printed twice or more times), out of sequence packet (packet with sequence number N + 1 in the sequence number to be printed before the packet N) .
7.2.3 Line SLIP link
Let us look at the SLIP link round-trip time, as they are often run in a low speed asynchronous mode, such as 9 6 0 0b / s or less. Recall that our serial line throughput 2.1 0 calculated. For this example, we SLIP link transmission rate between the host and the slip set bsdi 1200 b / s.
Now we can estimate the round-trip time. First of all, from the foregoing example P ing program output it can be noted, the default ICMP packets in the case where there are 56 bytes. Plus 20-byte IP header and 8-byte ICMP header, the total length of the IP datagram is 84 bytes (we can run tcpdum pe command to view the Ethernet data frames to verify this). Further, the section 24 can know, at least for two additional bytes: Start and end of data packets plus END character. Further, SLIP is also possible to add a frame number of bytes, but the data packets depending on the value of each byte. For the 1200 b / s this rate, since each byte contains 8 bit data, 1 bit 1 bit start bit and stop bit, the transmission rate per second is 120 bytes, each byte or 8.33 ms. So we need to estimate 1 4 3 3 (8 6 × 8. 3 3 × 2) ms (multiplied by 2 because we calculate the round-trip time).
The following output confirms our calculations:
(SVR 4 for, if the request must be sent once per second with the - s option). Round-trip time is about 1.5 seconds, but the program still 1 second intervals to send a ICMP echo request. This shows that before the first return an echo response (1. 480 a seconds time) has been transmitted twice echo request (at time 0 seconds and 1 second). This is why the summary line indicates that a packet is lost. In fact not lost packet, is likely to remain on the way back.
When we discussed in Chapter 8 traceroute program will go back and discuss this slow SLIP link.
7.2.4 dialup SLIP link
A dialup SLIP link, the situation changes somewhat because the ends of the link increases modem. Used between the sun and netb system provides modem modulation scheme is V. 3 2 (9600 b / s), V 4 2 Error control mode (also referred to as LAP - M). And V. 4 2 bis data compression . This simple calculation shows that we link parameters for the line are no longer accurate.
very
Multiple factors are likely to affect. Modem brings delay. With the compressed data, the packet length may be reduced, but the use of the error control protocol, and packet length may be increased. To release data received after the addition, the receiving modem can only be verified loop check character (checksum). Finally, we have to deal with computer asynchronous serial interface at each end, many operating systems only within a fixed time interval, or after the receipt of a number of characters to read these interfaces.
As an example, we ping a host gemini, output sun follows on the host:
Note that, a first RT T is not an integral multiple of 10 ms, but other row is an integer multiple of 10 ms. If we run the program several times, such a result is found each time (this is not a result of the resolution caused by the clock on sun, because the test results can be known in Appendix B provides its clock millisecond resolution rate).
Also note that the first one RT T larger than the other, and in descending order, and hovered between 2 8 0 ~ 300 ms. We let it run 1 to 2 minutes, RT T has been in the range of not less than 260 ms. If we calculate RT T (Problem 7.2) at a rate of 9600 b / s, then the observed values should be about 1.5 times the estimate.
If the run ping 60 seconds and calculates the average RT T observed, we found that in V. 4 2 V. 4 2 bis mode and an average value of 277 ms (which print out an average of the previous example better, because the longer running time, so put the start of a long time in equal shares). If we close V. 4 2 bis data compression, an average of 330 ms. If we close V. 4 2 error control mode (which is also closed V. 4 2 bis data compression), an average of 300 ms. A great influence on the parameters of these modems RT T using error control and data compression approach seems best.
7.3 IP record route option
ping program provides us see IP record route (RR) option opportunities. Most versions of ping Cheng Chapter 7 Ping program uses the -R option are available 65 order to provide a record routing function. It is provided such that the ping program I PR R options transmitted in IP datagram (IP datagram containing the ICMP echo request packet). Thus, each router processes the datagram regarded its IP address in the options field. When the data packets arrive at the destination, IP address should be copied to the list of ICMP echo reply, so the return address of the router through which the way has also been added to the list. When the ping program receives the echo response, it will print out this list of IP addresses.
This process sounds simple, but there are some drawbacks. RR option to generate source host, intermediate routers treatment options for RR, RR and copy the list of ICMP echo request in the ICMP echo reply, all of which are optional functions. Fortunately, most systems now feature support these options, but there are some systems do not copy the list of IP ICMP request in response to the ICMP. However, the biggest problem is the IP header only limited space to store IP addresses. We From Figure 3 - 1 can be seen, header length field of the IP header only 4 bit, so only up to the entire IP header includes a 5 32 bit long word (i.e., 60 bytes). Since the IP header is a fixed length of 20 bytes, RR options spent 3 bytes (we discuss below), so only 37 bytes (60-20-3) to store the list of IP addresses, That can only store nine IP addresses. For early ARPANET, the nine IP addresses seem to be a lot, but now appears to be very limited (in Chapter 8, we will determine the routing data reported by Tr aceroute tool). In addition to these shortcomings, the record route option works well, provides an opportunity to view detailed how to deal with IP options.
The general format of the RR option of the IP datagram in FIG 7--3 in FIG.
code is a byte specifies the type of IP options. For RR option, its value is 7. len is the total byte length RR option, in this case 39 (although the length may be smaller than the maximum length of RR option, but ping program always provide 39-byte option field, can record up to 9 IP addresses. due to limited space in the IP header option left, which generally are set to maximum length).
referred ptr pointer field. It is based on a pointer that points to a position in the stored IP address. Its minimum value is 4, the position of the first point stored IP address. With each IP address into the list, the value of ptr were 8,1 2,1 6, up to 36. When recording the next nine IP addresses, PTR value of 40, indicates the list is full.
When the router (by definition should be multi-homed) recording the IP address in the list, which address it should record it? Entry or exit address is the address? For this reason, RFC 791 [Postel 1981a] specifies the IP address of the router record exports. We will see later, when the original host (host running ping program) with the RR receives ICMP echo reply options, it also put its IP address in the entry list.
7.3.1 Common examples
We give an RR with the option to run ping example, run ping on the host-to-host svr 4 slip. An intermediate router (bsdi to) will process the data packet. Here is the output svr 4:
After four packet station 7 - (two stations each direction) shown in FIG. 4, each station of the IP address to see themselves RR list.
Router bsdi were added in different directions with different IP addresses. It is always the export of IP addresses to the list. We can also see that when the ICMP echo reply reaches the original system (svr 4), its own entrance to the IP address also joined the list.
You can also run with - tcpdump command v option to view packet switching performed on the host sun (see IP options). FIG output 7-- 5 shown in FIG.
Output optlen = 4 0 0 4 expressed byte option in the IP header space (IP header length must be an integral multiple of 4 bytes). RR {3 9} means that the record route option has been set, it is 39 length field. Then the IP address is 9, the symbol "#" is used to tag the IP address in the RR option ptr field is directed. Since we are looking at these packets (see FIGS. 7 - 4) Sun on the host, and therefore can see the IP address ICMP echo request list is empty, the ICMP echo reply has three IP addresses. We omitted in the other row tcpdump output, since they FIG 7--5 consistent.
At the end tag of the route EOL indicates the IP option "end of list (list end)" value. EOL option value may be zero. In this case represents 39 bytes of 40 bytes of data is located RR space in the IP header. Due to space before sending a datagram option is set to 0, with 0 character after RR 39 bytes of data would be interpreted as EOL. That's what we want results. If you have multiple options in the IP header option field, you must fill in a blank character before starting the next option, you can also use special characters NOP another value of 1 ( "no operation").
In Figure 7 - 5, SVR4 the echo request and the TTL field set to 3 2, BSD / 3 8 6 255 is set (it is printed because the router 254 is already subtracted bsdi 1). The new system is regarded ICMP packets TTL is set to maximum (255).
In the three TCP / IP systems used by the author, BSD / 3 8 6 and SVR4 support the record route option. That is to say, when forwarding a datagram, they can correctly update the RR list, but also to correctly copy the RR list of ICMP echo requests received to export the ICMP echo reply. While SunOS 4.1.3 in forwarding a datagram correctly update the RR list, but can not copy the list of RR. Solaris 2.x on this issue has been modified.
7.3.2 abnormal output
The following example is the author observed it as a starting point for Chapter 9 discusses the ICMP redirect messages. At 140. 252. 1 ping the host aix subnet (connected to the host via dialup SLIP sun access), and with a record route option.
Slip on the host running the following output:
We have been running this example on the host bsdi. Now select the slip to run it, look at all the 9 RR IP address list.
It is in the output puzzled as to why the outgoing datagram (ICMP echo requests) passed aix directly from netb, returned datagram (ICMP echo reply) never aix start and then through the router gateway netb ? One feature of IP routing here to see exactly what will be described below. After routing the datagram FIG 7-- 6 shown in FIG.
The problem is not aix should know the IP datagram destined for subnetwork 140 2 5 2.1 3 is sent to the host netb. Instead, aix has a default entry in its routing table, which indicates when no explicit route to a destination host when put all datagrams sent to the items specified default router gateway. Router gateway than any host on 140 2 5 2.1 subnet routing all have stronger ability (there are more than 150 hosts on the Ethernet, each host has a default routing table entry point to router gateway, so you do not run a routing daemon on each host).
There is no response to a question why not send a direct gateway ICMP redirect packets to aix (section 9.5), to update its routing table? For some reason (probably due to redirect datagram is generated by an ICMP echo request packet), Redirect did not produce. But if we use Te lnet log on to the daytime server on aix, ICMP redirect will produce 68 to use, so it routing table on aix also will be updated. If then the ping program with the record route option, which route data packets from netb display indicates to aix, then return netb, rather than through the router gateway.
ICMP redirect issues discussed in Section 9.5 in more detail.
7.4 IP timestamp option
IP timestamp option is similar to the record route option. The IP timestamp option FIG 7--7 shown (see the Figure 7 - comparing 3).
Code timestamp option is 0 x 4 4. The other two fields len and ptr with record route option: the total length of the option (typically 36 or 40) and a pointer to the next free space (3, 5,9,1).
The next two fields are 4 bit values: OF represents the overflow field, FL flag indicating the field. The operation is performed according to the timestamp option flags field, as shown in FIG 7--8 in FIG.
If the router can not increase because there is no space and time stamp option, it will increase the value of the overflow field.
Chapter 7 Ping program uses 69
The timestamp value is typically the number of milliseconds since midnight UTC meter, with ICMP timestamp request and response are similar. If the router does not use this format, it can be inserted at any time using its presentation format, but must be turned on to indicate that the time stamp in the upper non-standard value.
Compared with the record route option we had to limit the subject of a timestamp options to meet the situation worse number. If we want to simultaneously record the IP address and timestamp (bit = 1), it can be stored in four pairs of values which are at the same time. Only records the timestamp is useless, because we do not identify the correspondence between the timestamp and the router (unless there is a never change topology). Take 3 flag value would be better, because we can insert a timestamp of the router. A more fundamental problem is that it may not be able to control the time stamp on the correctness of any given router. This makes trying to use IP option to calculate the number of router hops between stations is futile. We will see (Chapter 8) traceroute program may provide a better way to calculate the number of router hops between stations.
7.5 Summary
ping program is an essential tool for two TCP / IP connectivity testing system. Only by using the ICMP echo request and echo reply messages, without going through the transport layer (TCP / UDP). P ing ICMP server typically implemented in the kernel function.
We analyzed the output of the ping program running in the LAN, and the WA N SLIP link (line and dial-up), and the SLIP Serial Line link throughput calculated. We also discussed and the use of the IP record route option ping program. With this IP option, you can see how it is often the default routing. In Chapter 9, we will once again return to the discussion topic. It also discusses the IP timestamp option, but it is limited in actual use.
