Lesson 58 · Operations

Troubleshooting: ping, traceroute and packet capture

A web page will not load. Instead of guessing, check one layer at a time: the link, the address and gateway, DNS, then the service itself. Use ping to see what answers and how fast, traceroute to reveal every router on the path as TTL runs out hop by hop, and a packet capture to see the real frames.

12 min11 steps5 questionsBeginner

Fig 58 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Your laptop's address is 169.254.37.12. Which layer should you look at first?

169.254.0.0/16 is the address a device gives itself when DHCP never answers (RFC 3927). Without a real address and gateway, nothing above can work.

02What does ping send, and what does it wait for?

Ping uses ICMP Echo Request (type 8) and Echo Reply (type 0), from RFC 792. The time between them is the round-trip time.

03A traceroute probe leaves with TTL 3. Which machine answers it, and with what?

Each router takes 1 off the TTL. The third router takes it to 0, drops the probe and sends Time Exceeded from its own address, which is how traceroute learns hop 3.

04ping 203.0.113.10 works, but ping www.example.com says the name is not known. Where is the fault?

The address ping proves the link, the gateway and the whole path work. Only turning the name into an address failed, and that is DNS's job.

05Ping to the server works, yet the web page will not load and a connection to port 443 gets a RST. What does that tell you?

Ping only shows the machine answers ICMP. A RST to a TCP SYN means nothing listens on that port (RFC 9293), so the fault is the service, not the network.

Key terms

Glossary

Ping: A tool that sends ICMP Echo Requests and reports each Echo Reply and its round-trip time.
ICMP: Internet Control Message Protocol: the small control and error messages of IP, such as Echo, Time Exceeded and Destination Unreachable.
Round-trip time (RTT): The time from sending a packet to getting its answer back, usually shown in milliseconds.
TTL: Time to live: a hop counter in every IPv4 packet. Each router takes 1 off; at 0 the packet is dropped.
Time Exceeded: The ICMP message (type 11) a router sends back when it drops a packet because its TTL reached 0.
Traceroute: A tool that sends probes with TTL 1, 2, 3 and so on, and lists the router that answers each one: the path.
Packet capture: Recording the frames a network card sends and receives, so every field can be read, as tools like Wireshark do.
Default gateway: The router a device sends every packet to that is not for its own local network.

Fine print

Notes and sources

192.168.1.0/24 is a private home range (RFC 1918); 192.0.2.7, 192.0.2.1, 198.51.100.2 and 203.0.113.10 are RFC 5737 documentation addresses; MACs are RFC 7042 documentation values. Round-trip times are illustrative.
Each router answers from the address of the interface that faces you, so traceroute shows those addresses. Traceroute sends three probes per TTL; the figure shows one.
Some routers and servers do not answer ping or traceroute probes at all. A row of * * * or a silent ping only means no answer came back, not that the path is broken.
A capture on the laptop sees addresses before NAT: the laptop's own 192.168.1.10, not the public 192.0.2.7. Capture only on networks you own or may test.

Quiz Unlocks after the last step.