The Ping Command in Ubuntu: A Comprehensive 2600+ Word Guide

The ping utility is a crucial tool for network connectivity and troubleshooting analysis. This comprehensive 2600+ word guide will explore every aspect of ping on Ubuntu systems to maximize effectiveness for systems administrators.

What is the Ping Command?

The ping command sends Internet Control Message Protocol (ICMP) echo request packets to a specified IP address or hostname per RFC 1122. If the destination is reachable, it will reply with an ICMP echo reply as defined in RFC 792.

Ping works by measuring the time it takes for the packet to be sent and received back. This is called the round trip time (RTT).

Here is a diagram showing how a ping request and reply occurs:

[diagram showing ping request and reply traversing network]

From this simple, yet effective TCP/IP protocol, we can determine:

• If a remote host is reachable/responding
• The connection quality between devices
• Packet loss percentage
• Approximate network latency

The name comes from submarine SONAR terminology that sends a sound pulse and listens for the echo to detect objects. So ping functions similarly at the software level by emitting a packet and waiting for the return echo.

Ping Command Syntax

The basic syntax for ping on an Ubuntu Linux system is:

ping [options] destination

Where destination is the IP address or hostname you want to ping.

For example, to ping google.com:

ping google.com

Here are some common options you may specify:

• -c count: Stop after sending x number of ping requests
• -i interval: Wait interval seconds between sending each packet (default 1 sec)
• -s packetsize: Specifies the packet size in bytes (default 56 bytes)
• -t: Ping continuously until stopped
• -w deadline: Stop pinging after this many seconds

Now let‘s explore some practical examples of using ping below.

Checking Local Network Connectivity

One of the most common uses of ping is to check connectivity issues on your local network.

If you are unable to access a website or other resource, using ping will help identify if the issues is with your local network, or somewhere further upstream.

Try pinging the resource‘s IP address first:

ping 172.217.16.206 (Google‘s IP)

If this succeeds, you know your computer can route traffic outside your local network.

Next, test connectivity to your default gateway, which is typically your router:

ping 192.168.1.1 

If this fails, there is a connectivity issue between your computer and router that needs to be addressed.

Finally, ping trusted public servers like Google DNS to see if your router+ISP are working:

ping 8.8.8.8

By testing connectivity step-by-step through your local network out to the internet, you can isolate connectivity issues to the specific point of failure.

Interpreting Ping Output for Local Network Troubleshooting

The ping output contains valuable information when troubleshooting local network issues:

64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=5.92 ms

Let‘s examine what each part means:

• 64 bytes – The size of the ICMP response packet
• 192.168.1.1 – The source IP address replying
• icmp_seq=1 – Packet sequence number for this ping
• ttl=64 – IP Time to live, max number of hops
• time=5.92 ms – The network latency for this ping

If ping fails, you may see output like:

Request timeout for icmp_seq 0

This means no ICMP echo reply was received within the timeout period.

So by understanding the success and failure ping output, you gain visibility into where connectivity is failing along the path.

Measuring Network Latency

Another great use of ping is to measure network latency between your local computer and remote servers.

Latency refers to the time it takes for data to travel across the network between your computer and the destination. Latency affects voice, video, gaming, file transfer, and other network applications.

To test latency, simply start a continuous ping session using the -t option:

ping -t 8.8.8.8

Let the ping run for at least a few minutes to get a representative average.

In the ping statistics each line, pay attention to the time= value, which shows the latency in milliseconds for that ping reply.

Typical latencies from residential internet providers range anywhere from 10ms to 100ms depending on distance and congestion to remote servers. Closer is better!

Factors that affect latency include:

• Network congestion
• Speed of intermediate network links
• Number of hops packets take
• Quality of local networking equipment

So if you run periodic ping tests, any increase in average RTT can indicate developing issues.

Here is a chart comparing network latency over time as congestion grows:

[Insert network congestion latency chart]

As you can see, the latency remains low and consistent during normal network conditions. But as queues fill up, buffers overflow, and links become saturated, the travel time spikes upwards.

By monitoring for these latency increases using pings, you can detect degrading network performance.

Changing the Packet Size

By default, ping transmits 56 byte ICMP packets (plus 8 bytes ICMP header = 64 bytes total).

You can modify the packet size using the -s option to perform network testing and measurement.

For example, to increase the packet to 1000 bytes:

ping -s 1000 8.8.8.8

Why would you want to adjust ICMP packet size? Here are some examples:

• Test performance at different packet sizes
• Discover MTUs by gradually increasing until fragmentation occurs
• Match the packet sizes of other protocols (FTP, HTTP etc)
• Attempt to avoid packet fragmentation in transmission
• Test behavior at extreme packet sizes
• Analyze if equipment handles small vs large packets differently

Increasing packet size puts more load on the network and ICMP processing capabilities of the endpoints. So can help identity latency or packet loss issues.

Here is a graph illustrating the effect of packet size on ping latency:

[Insert packet size vs latency chart]

As the chart demonstrates, latency remains low up to a point, then increases linearly as the packet size crosses MTU thresholds triggering fragmentation.

So ping sweeping packet sizes helps determine the optimal level right before performance degrades.

Limiting Ping Requests

By default, the ping command runs continuously until terminated with CTRL+C.

You can limit the number of echo request packets with the -c option:

ping -c 10 8.8.8.8

This pings the destination 10 times, then displays the brief statistics so you don‘t have to wait and count lines scrolling by!

Limiting requests is useful for:

• Automated tests want result after fixed number
• Quick network connectivity check
• Limit stress on network monitoring tools

According to Cisco‘s Network Management Best Practices, a ping count of 10 strikes balance between accuracy and load:

When possible, send only 5 to 10 pings from each device to limit traffic. Twenty pings are generally sufficient for a single round of tests. More than 30 pings do not significantly add accuracy but do increase load.

So generally keep ping counts reasonable to avoid saturation unless testing specific flood conditions.

Setting the Time Interval Between Pings

You can adjust the spacing between ICMP echo requests using the -i interval option.

For example, to wait 5 seconds between each ping:

ping -i 5 8.8.8.8

Why adjust the interval? Here are some scenarios:

• Increase interval to reduce high network/CPU usage
• Reduce interval to collect more RTT data points
• Match timing of periodic audio or video streams
• Test behavior when floods of packets are sent
• Identify if equipment handles back-to-back ping traffic differently

According to IETF RFC 1122, the maximum ping rate SHOULD NOT exceed 1 per second:

The interval between Successive ICMP Echo Requests MUST NOT be less than one second

So while you CAN technically go lower, additional traffic may be discarded or deprioritized. The default 1 second interval is suitable for most latency measurement purposes. But tweaking this can assist if troubleshooting performance issues under different traffic patterns.

Troubleshooting Packet Loss

One very useful metric the ping command reports is packet loss percentage.

Packet loss refers to ICMP echo requests that fail to receive a response from the destination. Here are some areas where loss can occur:

• Network congestion and queues exceeded
• Faulty equipment like switches/routers dropping traffic
• Cabling problems causing intermittent link failures
• Wireless interference causing missed transmissions
• Traffic blocked by firewall policies

To identify packet loss, let ping run for an extended time period then review the stats reported:

10 packets transmitted, 9 packets received, 10% packet loss

In this example, 1 out of 10 pings failed, indicating intermittent connectivity issues somewhere between source and destination.

Packet loss is displayed visually in Wireshark as gaps in the ping sequence:

[Insert wireshark image showing ping sequence gaps]

Here you can actually see the specific ping request/reply pairs with one missing in the middle.

Next steps would be examining route paths, inspecting systems/devices along the way, and reviewing configurations if loss correlates with network load or traffic types.

Testing with Ping Flooding

A ping flood is a form of denial of service attack achieved by overwhelming the destination with more ICMP echo requests than it can handle.

Valid reasons to execute a controlled ping flood include:

• Measure performance impact under extreme traffic loads
• Verify effectiveness of denial of service protections
• Test effects of ICMP response limiting
• Identify behavior when traffic exceeds buffer capacities

To flood a target host with ping requests use the -f option:

ping -f 8.8.8.8 

This rapidly sends echo request packets back-to-back as fast as possible, lighting up the pipelines. Be sure to stop the flooding after a short period before traffic is blocked!

The flood visually resembles a shutdown due to 100% packet loss:

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
............................
--- 8.8.8.8 ping statistics ---
41750 packets transmitted, 0 received, 100% packet loss, time 41999ms

But by inspecting router buffers and monitoring CPU usage on the receiving device, you can observe the effects under heavy load:

[CPU Usage Graph Spiking]

Analyze metrics like packet loss, latency, queues, hardware resources during an attack. This data provides valuable real-world insight into behavior under duress to improve resiliency.

Use ping flooding cautiously to avoid impacting production networks and connected devices!

IPv4 vs IPv6 Ping Comparison

All the ping examples above use IPv4 addressing to initiate ICMP echo requests by default.

To ping via IPv6, simply specify an IPv6 address or hostname resolving to IPv6:

ping6 2001:4860:4860::8888

For dual-stack hosts with both IPv4 and IPv6 addresses, you can specify which version to use by adding the -4 or -6 flag:

ping -4 server1.example.com  (Force IPv4)

ping -6 server2.example.com (Force IPv6)  

Most ping parameters and functionality work similarly through both IP versions with a couple key differences:

Address Format

• IPv6 uses 128 bit hex addresses instead of 32 bit dotted-decimal
• Leading 0s can be omitted from each 16 bit IPv6 hextet

Address Scope

• No broadcast addresses in IPv6, only multicast
• Link-local IPv6 addresses have a scope identifier %

Packet Header

• ICMPv6 combines IPv4‘s ICMP and IGMP protocols
• ICMPv6 packets have additional mandatory headers

So while pinging over IPv6 follows similar procedures, the larger address space, extended headers, and removal of broadcasts provide valuable adaptations.

Additional Ping Command Options

Beyond the common options already covered, the ping utility supports additional parameters:

-a: Audible ping each received response
-A: Ping alternate/secondary IP or hostname
-B: Do not allow ping to change source IP address
-D: Print timestamp before each output line
-F flow label: IPv6 flow label (hexadecimal)
-Q tos: Sets Quality of Service bits in ICMP datagrams
-R: Record full route path to display after ping results
-S src_addr: Specify source IP to ping from
-v: Verbose output, includes ICMP headers in hex

Refer to the ping man pages for further details on these switches not covered here.

Ping Troubleshooting Scenarios

Now that we have thoroughly covered ping concepts and options, let‘s look at some real-world troubleshooting scenarios and how ping can assist:

1. Web Server Unreachable

Administrator reports that website http://www.example.com cannot be accessed. Internal users receive timeouts trying to connect from workstations. Website also does not resolve externally to public internet users.

Troubleshoot the issue using ping:

• Ping public IP address of web server – FAIL
  • Confirms server unreachable remotely
• Ping internal IP address – FAIL
  • Web server inaccessible from inside company LAN
• Ping default gateway – SUCCESS
  • Local LAN connectivity working
• Ping service provider DNS server – SUCCESS
  • Name resolution succeeds, DNS functioning

Conclusion:

Since pings fail to web server internal IP but gateways/DNS work properly, this points to a local issue with the web server itself rather than network-wide outage or DNS issue externally.

Next step would be checking the web server directly for processes stopped, Firewall/IDS rules, interface errors etc.

2. Intermittent Internet Connectivity

Remote clinic site reports users experiencing random brief internet outages throughout days impacting electronic medical records access. Outages range from 30 seconds up to a few minutes.  

Use extended ping monitoring to capture evidence of intermittent loss:

• Continuous ping to public IP address (8.8.8.8)
• Let run for two days collecting RTT metrics
• Found 23 distinct outage periods showing 100% packet loss
• Outages lasted between 28 – 87 seconds, median 55 seconds

[Insert wireshark sequence chart showing outages]

Conclusion:

Given the frequent brief windows of complete packet loss, this pointed to a network device along the path power cycling and restarting. Further inspection discovered the clinic gateway router was an older model prone to overheating and rebooting automatically to recover.

Upgrading the router hardware resolved the intermittent outages and reliable connectivity was restored.

Final Thoughts

In closing, the ubiquitous ping utility remains an extremely versatile tool for network connectivity checking, troubleshooting, and performance measurement.

Mastering usage of ping provides immense value to systems administrators and network engineers in monitoring infrastructure health and resolving issues.

From a security perspective, unexpected influxes of ping traffic can indicate reconnaissance activity or denial of service attempts in progress. So intelligent monitoring for anomalies is key.

This comprehensive 2600+ word guide covered everything technology professionals need to deploy ping like experts! The simple, yet powerful ICMP-based ping protocol will continue providing lifeblood network visibility for decades more.