Behind-the-scenes Process of "Ping"

Behind-the-scenes Process of "Ping"

Take the following network as an example: There are four sub-machines A, B, C, and D, one route RA, and the subnet mask is 255.255.255.0. The default route is 192.168.0.1.
1. Within the same network segment
What happened after running "Ping 192.168.0.5" on host? First, the Ping command will construct a fixed format ICMP request data packet, and then the ICMP protocol will send this data packet together with the address "192.168.0.5" to the IP layer protocol (like ICMP, is actually a group of processes running in the background). The IP layer protocol uses the address "192.168.0.5" as the destination address, the local IP address as the source address, and some other control information to construct an IP packet, and try to get the MAC address 192.168.0.5 (physical address, which is required for frame transmission unit of data link layer constructed by the data link layer protocol), so that it can be handed over to the data link layer to build a data frame. The key is here. Through the IP address of machine B and its own subnet mask, the IP layer protocol finds that it is in the same network as itself, and finds the MAC of this machine in this network directly, if the previous two machines had communication, there should be A ing between the IP address of machine B and the MAC address in the ARP cache table of machine A. If not, send an ARP request broadcast to obtain the MAC address of machine B, and send it to the data link layer. The latter constructs a data frame. The destination address is the physical address transmitted from the IP layer, the source address is the physical address of the local machine, and some control information is attached, according to the Ethernet Media access rules, send them out.
After receiving the data frame, host B checks its destination address and compares it with the physical address of the Local Machine. If yes, it receives the data frame; otherwise, it is discarded. After receiving the data frame, check the data frame and extract the IP data packet from the frame to the local IP layer protocol. Similarly, after the IP layer check, extract the useful information and send it to the ICMP protocol. After the latter completes the process, build an ICMP response packet and send it to host, the process is exactly the same as that when host A sends an ICMP request packet to host B.
2. Not in the same CIDR Block
After "Ping 192.168.1.4" is run on host A, it starts to be the same as above. When the MAC address is obtained, the IP protocol finds that host D is not in the same network segment as host, the route will be processed directly, that is, the MAC of the route will be taken over. As for how to obtain the MAC of the route, just like above, first find it in the ARP cache table and broadcast it if it cannot be found. After the route obtains the data frame, it will contact host D. If it cannot be found, it will return A timeout message to host.


Figure 1 Network
Analysis of information returned after Ping
1. Request timed out
This is a message that people often encounter. Many articles have said that this is because the recipient's machine has set ICMP packet filtering. From the previous work process, this is not completely correct. There are at least several situations.
(1) the other party has shut down, or there is no such address on the Network: for example, PING 192.168.0.7 in host A, or host B has shut down, PING 192.168.0.5 in host A to obtain timeout information.


(2) If the other party is not in the same network segment as the other party, the other party cannot be found through the route. However, sometimes the other party does exist. Of course, the timeout information is returned if the other party does not exist.
(3) The peer does exist, but ICMP packet filtering (such as firewall setting) is configured ).
How can we know whether the other party exists or does not exist? We can use the Ping command with the-a parameter to test the other party's NETBIOS name. If the other party's NETBIOS name can be obtained, it indicates that the other party exists, there is a firewall setting. If not, most of them do not exist or shut down, or are not in the same network segment.
(4) Incorrect IP Address Setting
Under normal circumstances, a host should have one Nic, one IP address, or multiple NICs, and multiple IP addresses (these addresses must be in different IP subnets ). However, if a computer's "dial-up network adapter" (equivalent to a soft Nic) TCP/IP Settings, set an IP address in the same subnet as the nic ip address, in this way, in the IP layer protocol, this host has two different interfaces in the same network segment. When you Ping other machines from this host, the following problems may occur:
A. The host does not know which network interface to send data packets to, because two network interfaces are connected to the same network segment.
B. The host does not know which address is used as the source address of the data packet. Therefore, if you Ping other machines from this host, the IP layer protocol will not be able to process it. After the timeout, Ping will give an error message indicating "no response timeout. However, when you Ping the host from another host, the request packet is sent from a specific network adapter. ICMP only needs to swap the destination and source addresses and change some signs, the ICMP response packet can be sent smoothly, and other hosts can successfully Ping this machine.
2. Destination host Unreachable
(1) the other party and himself are not in the same CIDR block, but they have not set the default route. For example, in the previous example, machine A does not set the default route, run Ping 192.168.0.1.4 and "Destination host Unreachable" will appear ".
(2) network cable failure
This section describes the differences between "destination host unreachable" and "time out". If the route table of the router that passes through has a route to the target, and the target cannot be reached for other reasons, at this time, "time out" will appear. If no route is connected to the target in the route table, "destination host unreachable" will appear ".
3. Bad IP address
This information indicates that you may not be connected to the DNS server, so you cannot resolve this IP address, or the IP address may not exist.
4. Source quench received
This information is special and has very low probability of appearance. It indicates that the other party or the server in the middle is busy and cannot respond.
5. Unknown host -- Unknown host
This error message means that the remote host name cannot be converted to an IP address by the Domain Name Server (DNS. The cause of the failure may be that the Domain Name Server is faulty, its name is incorrect, or the communication line between the system of the network administrator and the remote host is faulty.

6. No answer -- No response
This fault indicates that the local system has a route to the central host, but it cannot receive any information sent to the central host. The fault may be caused by one of the following reasons: the central host is not working; the network configuration of the local or central host is incorrect; the local or central router is not working; and the communication line is faulty; A routing problem exists in the central host.
7. Ping 127.0.0.1: 127.0.0.1 is the local loop address.
If the address cannot be pinged, the TCP/IP protocol on the local machine cannot work normally.
8. no rout to host: The NIC is abnormal.
9. transmit failed, error code: 10043 the NIC Driver is abnormal.
10. unknown host name: the DNS configuration is incorrect.