Diagnose Network Issues with Ping and Traceroute

1. ping: The Network Sonar

The ping command is your first-line tool for checking network connectivity. Its function is simple: it sends a small message to a target host and waits for a reply. It's like shouting "Are you there?" across the network and listening for a "Yes, I'm here!" in response.

This "conversation" uses a specific language called the Internet Control Message Protocol (ICMP).

• Your machine sends an ICMP Echo Request.
• The target machine, if it's online and not configured to ignore you, sends back an ICMP Echo Reply.

Let's watch a video that introduces the command and its purpose.

Using ping in Your Terminal

Now, let's put this into practice. Open your terminal and try pinging a well-known server.

ping google.com

You'll see a continuous stream of replies. On Linux, ping will run indefinitely until you stop it. To stop it, press Ctrl+C.

When you stop the command, you'll see a summary of the session. Let's look at the key pieces of information from a single reply line:

64 bytes from lhr48s12-in-f14.1e100.net (142.250.187.238): icmp_seq=1 ttl=118 time=11.5 ms

• icmp_seq: The sequence number. Since packets can arrive out of order, this helps keep track.
• ttl=118: Time To Live. This is a value that prevents packets from looping forever on the internet. Each router (or "hop") the packet passes through decreases the TTL by 1. If it hits 0, the packet is discarded. It can give you a rough idea of how many hops away the target is.
• time=11.5 ms: The Round-Trip Time (RTT). This is the latency—how long it took for the packet to go to the target and come back. This is a key indicator of network performance.
• Packet Loss: In the final summary, 0% packet loss is what you want to see. A high percentage indicates a problem somewhere on the network path.

Practical ping Usage

A continuous ping isn't always what you need. You can specify the number of pings to send with the -c (count) flag.

ping -c 4 google.com

This will send exactly four pings and then stop automatically, which is similar to the default behavior of ping on Windows.

To see these options in action and learn about some classic troubleshooting scenarios, let's return to our video.

A quick note for hacking: ping is a fundamental tool for reconnaissance (the information-gathering phase). An attacker will often perform a "ping sweep" across a range of IP addresses to discover which hosts are online. However, be aware that many firewalls are configured to block ICMP traffic to make systems "invisible" to simple pings. A failed ping doesn't always mean the host is offline.

2. traceroute: Mapping the Journey

What if ping fails? You know there's a problem, but where? Is it your local router, an issue with your ISP, or a problem near the destination server? That's where traceroute comes in. It shows you the sequence of routers—the "hops"—that your packets pass through on their way to the destination.

How traceroute Works: The TTL Trick

traceroute works by cleverly manipulating the Time To Live (TTL) field we saw in the ping output.

1. It sends a packet to the destination with a TTL of 1. The first router on the path receives it, decreases the TTL to 0, and discards the packet. It then sends an ICMP "Time Exceeded" message back to you. traceroute records this router's IP address.
2. Next, it sends a packet with a TTL of 2. This packet makes it past the first router (which decrements TTL to 1), but is stopped by the second router, which sends back another "Time Exceeded" message.
3. This process continues, incrementing the TTL by 1 each time, revealing each hop along the path one by one.

This diagram provides a great visual summary of the process.

For a more detailed explanation of this mechanism, the following article is excellent.

Using traceroute and Its Variations

To use it, just type traceroute followed by a destination.

traceroute google.com

You'll see a list of hops, with the IP address (and sometimes hostname) and the round-trip time for three separate test packets (probes) to that hop. If you see asterisks (* * *), it means that router did not reply to the probe, likely due to a firewall or configuration.

A critical point for you as a Linux user is that traceroute works differently on different operating systems.

• Linux & macOS: By default, traceroute sends UDP packets to a high-numbered, likely unused port. When the packet reaches the final destination, the host's OS sees that no service is listening on that port and sends back an ICMP "Port Unreachable" message, which signals to traceroute that the destination has been reached.
• Windows (tracert): Uses ICMP Echo Requests, just like ping.

The following video dives deep into how traceroute works, using Wireshark to show you the exact packets being sent and received. It also clearly demonstrates the difference between the Windows and Linux implementations.

As the video mentioned, you can force the Linux traceroute to behave like the Windows version by using the -I (for ICMP) flag. This can be useful if a firewall is blocking the default UDP probes but allowing ICMP.

# Force traceroute to use ICMP Echo packets instead of UDP
traceroute -I google.com

3. Hands-On Investigation

Time to use these tools yourself.

Activity 1: Ping Practice
In your terminal, run the following commands:

1. ping -c 4 127.0.0.1 (This is your loopback address, or "localhost". It should be instant).
2. ping -c 4 <YOUR_ROUTER_IP> (Find this with ip r. It should be very fast, likely < 5ms).
3. ping -c 4 8.8.8.8 (Google's public DNS server. A good baseline for your internet latency).
4. ping -c 4 192.0.2.1 (This is a non-routable test IP. It should fail with Destination Host Unreachable or 100% packet loss).
   Compare the time= and summary statistics for each.

Activity 2: Traceroute Exploration

1. traceroute google.com
2. traceroute bbc.co.uk (A server in the UK).
3. traceroute anu.edu.au (A server in Australia).
   Compare the number of hops and the final latency. You should see a significant increase for the server that is physically farther away.

Activity 3: Compare Traceroute Methods

1. traceroute -q 1 archlinux.org (The -q 1 sends only one probe per hop to speed it up).
2. traceroute -q 1 -I archlinux.org (This does the same trace using ICMP).
   Do you get the same path? Sometimes one method works better than the other depending on network firewalls.

Conclusion

You now have two of the most essential network diagnostic tools in your arsenal. You've moved from just looking at the map (ip route) to actively probing the roads.

Key Takeaways:

• ping is used to test reachability and measure latency (RTT) using ICMP Echo Requests/Replies.
• A failed ping doesn't guarantee a host is offline; firewalls can block ICMP.
• traceroute is used to map the path to a destination by sending packets with incrementally increasing TTL values.
• The traceroute implementation on Linux (UDP packets) differs from Windows' tracert (ICMP packets). You can use traceroute -I on Linux to use the ICMP method.
• These tools are the first step in both network troubleshooting and security reconnaissance.

Next Lesson Preview:
We've confirmed a host is online (ping) and we know the path to get there (traceroute). The logical next step in reconnaissance is to see what doors are open on that host. In the next lesson, we will learn how to identify which processes are listening on network ports using ss and netstat. This is how you begin to discover the services (like web servers or SSH) running on a target machine.