-: Ping and traceroute. 2 2
In this video, 3 3
we're going to cover the ping and traceroute command-line tools 4 4
and how to use them in maintaining 5 5
and troubleshooting our networks. 6 6
First, we have ping, 7 7
ping is used in checking the connectivity 8 8
between two devices and we often use this 9 9
in network troubleshooting. 10 10
There are a couple of different ways to use ping, 11 11
but the most common way is to just type in ping 12 12
and the domain name you want to test. 13 13
For example, if you're on a Windows machine, 14 14
you can enter ping www.jasondion.com 15 15
and hit Enter. 16 16
And this is going to send out four pings 17 17
and get four replies. 18 18
And it tells you the site is either up or down. 19 19
This is the default one that you're going to use. 20 20
Now, if I wanted to get 10 or 20 or 30 pings, 21 21
I can do that by doing ping -n and then the number. 22 22
So ping -n 10 jasondion.com 23 23
will ping jasondion.com 10 times, and then it will stop. 24 24
Now, you can also do this 25 25
where it will just keep pinging over 26 26
and over and over again forever. 27 27
To do this, 28 28
you're going to use ping -t and the domain name. 29 29
So in this example, I would do ping -t jasondion.com 30 30
and it would go forever and ever keep pinging that site. 31 31
Now, why would I want to do that? 32 32
Well, it might be useful to see 33 33
if your WAN link is up all the time. 34 34
In some places I've worked, 35 35
we've had a ping, constantly running on a distant end 36 36
and we leave it up on a big screen monitor. 37 37
Then we could just look up 38 38
and we could see if that connection is working or not, 39 39
or if it's having any issues. 40 40
Now in the examples I just gave you, 41 41
I was working on a Windows client, 42 42
but ping does work a little differently 43 43
if you're using Linux, Unix or OSX. 44 44
One of the key differences, is that on a Windows machine, 45 45
it only sends four pings by default and then it stops. 46 46
If we wanted it to run forever, 47 47
we'd use the -t option, like I said. 48 48
Now, in Linux, Unix and OSX clients, 49 49
ping is going to run continuously by default, 50 50
just like that -t and Windows did. 51 51
Now, if you only want to send four pings 52 52
like we did in Windows, 53 53
we would have to do that by doing the -c command, 54 54
which stands for count. 55 55
So it'd say -c 4 after my ping command. 56 56
So I would do ping -c 4 jasondion.com. 57 57
Or if I wanted to do 10, I could do ping -c 10 jasondion.com 58 58
and then stop. 59 59
Really, you can use any number 60 60
of pings you want with the -c option 61 61
and it works like the -n option you had in Windows. 62 62
If you're running pin continuously on any operating system 63 63
and you want to stop it at any time, 64 64
you can issue the break command. 65 65
To do this, 66 66
you simply press the Control key and C, 67 67
and this will end up breaking or stopping 68 68
that continuously running ping. 69 69
The last option we need to cover is the -6 option. 70 70
If you enter ping -6 and the domain name, 71 71
this is going to force the ping to go over IPv6, 72 72
instead of IPv4. 73 73
This -6 option is going to work the same 74 74
regardless of the operating system you're using. 75 75
So what does all this look like in the real world? 76 76
Well, here you can see, 77 77
I did a ping of jasondion.com from my Windows machine, 78 78
and it sent out four pings and received four replies. 79 79
Here you can see the time it took, 74 milliseconds, 80 80
74 milliseconds, 156 milliseconds and 71 milliseconds. 81 81
This gave me an average of 93 milliseconds 82 82
across all four pings and all four pings were sent 83 83
and all four packets will receive back. 84 84
This indicates that my web server is up 85 85
and accepting traffic at this time. 86 86
Now, next, we have traceroute 87 87
and this can be written 88 88
as either traceroute all written out 89 89
or tracert if you're on a Windows system. 90 90
If you're on a Unix, Linux or OSX system, 91 91
you're going to enter that command as traceroute. 92 92
Now, either way, we pronounce it the same way, 93 93
we call it traceroute. 94 94
Now, traceroute is going to be used to display the path 95 95
between your device and its destination, 96 96
showing the source and destination IP address 97 97
along every single hop as you go. 98 98
Now, hop is simply any router or firewall 99 99
that's there as part of the layer three path 100 100
in that transmission, 101 101
going from the client to the destination. 102 102
To perform a traceroute, 103 103
simply enter the traceroute and the IP address 104 104
or domain name of the destination you want to reach 105 105
from your client. 106 106
Now in response, 107 107
you're going to get a list of all the routers 108 108
between you and the computer you're trying to get to. 109 109
If you want to do this using IPv6, instead of IPv4, 110 110
you can add the -6 option to your traceroute command. 111 111
Now, let's look at quick example here 112 112
by doing a traceroute to www.diontraining.com 113 113
from my workstation. 114 114
Notice, it's going to go out 115 115
and resolve the IP address for us automatically. 116 116
Then it starts tracing out the route 117 117
from my computer with a source IP of 10.0.2.2 118 118
out to the destination IP of 54.221.229.100. 119 119
Now, how does traceroute work? 120 120
Well, it's going to use the time to live field 121 121
in the IP packet header. 122 122
Normally, the TTL or time to live is going to be used 123 123
to prevent packets from being forwarded 124 124
around the internet indefinitely by routers. 125 125
This would create a routing loop, right? 126 126
So we don't want that to happen. 127 127
Instead, each time a packet is forwarded by a router, 128 128
it takes one off of that time to live. 129 129
So if the time to live reaches zero, 130 130
that packet is dropped and discarded 131 131
and response gets sent back with an error message. 132 132
So traceroute actually uses this to its advantage, 133 133
and it sends out a series of packets to the destination. 134 134
The first packet is going to be sent out 135 135
with a time to live of one. 136 136
It's going to hit that first router 137 137
and then that's going to decrease it's time to live to zero 138 138
because it hit zero, it's going to now drop the packet 139 139
and send back an ICMP message 140 140
that says, 141 141
time exceeded for that packet back to the source IP 142 142
and informs it, 143 143
that that packet didn't make it to the final destination 144 144
and it was dropped. 145 145
Then traceroute sends out another packet. 146 146
This time, it has a time to live of two. 147 147
Again, it goes through the first router 148 148
and it hits the second router. 149 149
At that point, it's hit zero again. 150 150
And so it's going to go back to the original sender. 151 151
This continues over and over again 152 152
until traceroute finally gets 153 153
to the final destination successfully. 154 154
But the entire time it keeps incrementing 155 155
that time to live one, every time it sends out a new packet. 156 156
This way, 157 157
it can identify each and every router or hop 158 158
along the source to destination. 159 159
Now, sometimes you're going to come across something 160 160
that looks a bit strange in your traceroutes output. 161 161
For example, notice here around line 15, 162 162
I have a bunch of timeout requests, 163 163
even though my server is up and running. 164 164
What does this mean? 165 165
Well, this means you're seeing a firewall on our path 166 166
or some other kind of device 167 167
that's not responding to ICMP or ping traffic. 168 168
This is a security feature of a lot of firewalls. 169 169
So my traceroute command simply reports back 170 170
that the response that it received 171 171
or in this case didn't receive from that device at that hop. 172 172
Now, this still tells me there's some kind of device there, 173 173
but I know it's filtering that traffic. 174 174
And so I'm now being able to fingerprint your network 175 175
and figure out where your firewalls are. 176 176
In this case, 177 177
my service provider for diontraining.com does not respond 178 178
to those types of request. 179 179
Therefore, I can only trace the path 180 180
as far out as the outermost layer of their network. 181 181
Once I get to the outermost layer of their network, 182 182
their border gateway, 183 183
it's going to stop responding to my request 184 184
and I'm going to receive timeout messages. 185 185
But I won't be able to see all the information 186 186
about the routers and firewalls there, 187 187
except to know there is something there. 188 188
And I can see that by those stars that are existing. 189 189
Now, when it comes to troubleshooting your network, 190 190
you can use ping to determine 191 191
if you have a network connection 192 192
from your source to your destination without any issues. 193 193
If someone's complaining 194 194
that their network connection isn't working, 195 195
I usually follow a simple four-step process 196 196
to determine where that issue is occurring. 197 197
First, I'm going to try to ping google.com 198 198
or some other really big website 199 199
that's always up and available. 200 200
If this works, 201 201
I know my network connection is good 202 202
and the internet connection is good. 203 203
And in this case it would be a user issue 204 204
that's specific to a website they're trying to access. 205 205
If I can't ping google.com successfully, 206 206
I'm going to switch to pinging an IP address, 207 207
something like 8.8.8.8 208 208
and I'll see if that works. 209 209
Now, 8.8.8.8 is a great IP address to use 210 210
for a couple of reasons. 211 211
First, it's really easy to remember, 212 212
it's just four eights. 213 213
Second, it's the DNS server for Google. 214 214
So it has an extremely high rate of availability 215 215
and reliability. 216 216
So it's almost always up and it makes a great IP to use 217 217
for your troubleshooting. 218 218
Now, if you can ping 8.8.8.8 successfully, 219 219
this indicates your internet connection is working, 220 220
but I'm probably having DNS issues 221 221
because I couldn't resolve google.com 222 222
to its proper IP address and ping it. 223 223
At this point, 224 224
we would shift our troubleshooting efforts 225 225
towards the DNS issue either with our local DNS cache 226 226
or our DNS server. 227 227
Now, if you can't ping 8.8.8.8, 228 228
this means you can't reach the internet successfully. 229 229
So we need to go back and refocus our efforts 230 230
by moving inwards by one step. 231 231
Now, I'm going to ping my default gateway, 232 232
my router or my modem. 233 233
This way, I can see what the internal IP addresses 234 234
of that border gateway router 235 235
and see if I can reach it. 236 236
For example, in my home office, 237 237
we're using a private IP range of 192.168.1.0/24, 238 238
so my default gateway is 192.168.1.1. 239 239
If I can ping that IP address and it goes successfully, 240 240
this means I have a good connection 241 241
from my client all the way through my switches and routers 242 242
up to that border gateway router. 243 243
So now I can know the issues 244 244
between my border gateway router 245 245
and the 8.8.8.8 server, 246 246
because something is wrong with our internet connection, 247 247
maybe our modems offline or something like that. 248 248
So we'll troubleshoot in that half of the network. 249 249
Now, if I can't ping the default gateway, 250 250
that means there's an issue between my client 251 251
and my border gateway. 252 252
This can be anything, 253 253
it could be cabling or switches or anything else 254 254
in between those two devices, 255 255
including my local workstation itself. 256 256
So the next thing I want to ping 257 257
is my local client's IP address. 258 258
For example, 259 259
if your IP address is 192.168.1.23 260 260
and your default gateway was 192.168.1.1, 261 261
you're going to ping the local IP address 262 262
of 192.168.1.23 263 263
and you'll see if that works. 264 264
If pinging that does work, 265 265
this means that you have an issue 266 266
between your network card and the default gateway. 267 267
So you need to check your cabling and your switches 268 268
and all the things outside of your device. 269 269
Now, if you can't ping your local IP address, 270 270
that means you now need to ping your local host 271 271
of 127.0.0.1. 272 272
If you can, 273 273
that means your network card 274 274
and its drivers are properly installed. 275 275
If you can't, 276 276
that means you need to re-install your network card drivers, 277 277
because there's most likely something being corrupted 278 278
in there. 279 279
As you can see by just using my ping command, 280 280
I can quickly identify where the issue is. 281 281
Is it on the internet side? 282 282
Is it a problem with my modem or my router? 283 283
Or is it a cabling or switch issue? 284 284
Or maybe it's a client or driver issue? 285 285
By doing these four steps, you can figure it out. 286 286
Now, if the issue is between the router and the destination, 287 287
this is where traceroute is going to become really helpful 288 288
for you, 289 289
because I can identify all the routers are being used 290 290
between my client and the destination. 291 291
And then I can see where the data stops flowing. 292 292
Then if I own that device, 293 293
like an internal router or firewall, 294 294
I can check its configuration 295 295
and work to restore those services. 296 296
(gentle music)