13

When I ping a server there are two kinds of result I might get:

  • Timeout
  • Host is down message

How does the ping command know if a host is down? In both cases, the host does not send any response to the ping packet, so how can ping tell the difference?

Mark Amery
  • 727
  • 1
  • 8
  • 25
Bob5421
  • 319
  • 3
  • 8
  • 16
  • 2
    Possible duplicate of [Interpreting PING Results](https://serverfault.com/questions/731037/interpreting-ping-results) – kubanczyk Apr 10 '19 at 19:12

3 Answers3

25

Differences between responses are not actually determined by ICMP itself but rather indirectly.

ICMP can distingush between the following:

  0 = net unreachable;

  1 = host unreachable;

  2 = protocol unreachable;

  3 = port unreachable;

  4 = fragmentation needed and DF set;

  5 = source route failed.

But it does so with other network resources. Codes 0, 1, 4, and 5 may be received from a gateway. Codes 2 and 3 may be received from a host.

If, according to the information in the gateway's routing tables, destination network is unreachable, (e.g., the distance to the network is infinity), the gateway may send a destination unreachable message to the internet source host of the datagram. In addition, in some networks, the gateway may be able to determine if the internet destination host is unreachable. It is the Gateways in these networks that can send destination unreachable messages to the source host when the destination host is unreachable, so it's not actually ICMP doing the determinations.

In the case that in the destination host, the IP module cannot deliver the datagram because the indicated protocol module or process port is not active, then the destination host may send a 'destination unreachable' message to the source host.

Finally, if a datagram must be fragmented to be forwarded by a gateway yet the 'Do not Fragment' flag is on, the gateway will discard the datagram and will return a 'destination unreachable' message.

Now to difference between the 2 separate cases: Request Timed Out means that no Echo Reply messages were received within the set time. This can be due to many different causes: ARP request failure, network congestion, packet filtering, routing error, or a even silent discard.

When you get a Reply From [IP address]: 'Destination Host Unreachable,' then the problem occurred at/after a remote router, whose address is indicated by the [IP address]. So it's a router telling you that there is a problem between it and the destination address.

Overmind
  • 3,076
  • 2
  • 16
  • 25
  • 3
    no router or other device needs to be involved. Both Windows and Linux produce "host unreachable" if the host is in a local subnet and there is no ARP entry. – Oh My Goodness Mar 21 '19 at 15:53
  • If a host is unreachable it cannot produce a receivable-by-initiator answer. – Overmind Mar 22 '19 at 07:25
  • The pinging host produces the message. Obviously the destination cannot. – Oh My Goodness Mar 22 '19 at 07:34
  • That comes form the gateway. – Overmind Mar 22 '19 at 07:40
  • No. "Gateway" is a layer 3 construct. There is no routing, and thus no gateway involved at all when pinging a host on the local subnet. – Oh My Goodness Mar 22 '19 at 07:53
  • Physical gateway address is L2. Logical gateway address is L3. We can talk more via chat if you want. – Overmind Mar 22 '19 at 08:08
  • Instead of inventing networking concepts and then citing them as fact, just unplug your ethernet cable and try it. – Oh My Goodness Mar 22 '19 at 08:10
  • Completely disconnected is one thing, being in a network is another. – Overmind Mar 22 '19 at 08:20
  • Nope. Another wrong guess that you could have easily tested. I suggest you remedy the gaps in your understanding, test your ideas before posting them as fact, or add question marks to the end of all your posts. – Oh My Goodness Mar 22 '19 at 09:51
  • I strongly suggest you drop opinions and check some actual sources, example: the ones called RFC http://www.networksorcery.com/enp/protocol/icmp/msg3.htm Quote "The ICMP destination unreachable message is generated by a router to inform the source host that the destination unicast address is unreachable." – Overmind Mar 22 '19 at 11:26
  • Good find. And which device do you think acts as "the router" when the destination is local? Hint: it's the originating host. The external gateway, on a switched network, will never even see the ping. – Oh My Goodness Mar 22 '19 at 11:32
  • That is why I said there are 2 separate cases. – Overmind Mar 22 '19 at 11:36
  • Nowhere does your post suggest that the local host may generate these messages on its own. See also your comment: "*That comes from the gateway*" in response to my "*that comes from the host*"; you clearly believed they were two different things, or else why post that comment at all? tl;dr: OP says "*'Destination Host Unreachable,' [means] the problem occurred at/after a remote router*" and this is not correct in the local case, which is exactly what I posted in my very first comment. – Oh My Goodness Mar 22 '19 at 12:12
  • Trying to ping a server implies that at least you are connected to something else, so the isolated local case is excluded from start. – Overmind Mar 22 '19 at 12:35
  • You are really lost here. "Local" means local **subnet**, which might contain thousands of hosts. And you can be connected to the internet at the same time, or any number of other networks via gateways. One has nothing to do with the other. – Oh My Goodness Mar 22 '19 at 13:32
  • Local means local station in the context above. – Overmind Mar 25 '19 at 05:59
4

Host is down message:

This indicates that you don't know a route to the desired destination, or a remote router reports that it has no route to the destination.

Timeout:

Indicates the absense of Echo Reply messages. No package were received within the default time.

SantiCarta
  • 56
  • 4
-2

You cant ping if the computer isnt connected to the internet because by pinging you actually request the ip of the host .

Altair
  • 11