ICMP, Ping, and Traceroute – What I wish I was taught (2020)
1–10 of 40 posts
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#2No post body was provided.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#3Another common basic test for at-least windows clients that you should also add to the beginning is when you run a ping test and has the reply of your own host IP.
I don’t know how many times I’ve had systems admins or engineers come to me saying there’s a network is but there NIC port is misconfigured. This usually happens due to two NICs being configured or they something else tuned incorrectly with vlan tagging at the nic under properties or the vswitch is incorrectly configured.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#4Great article, I learned more about these daily-use tools.
An easy trick I use a lot is host OS identification via ICMP. A TTL of around 64 is Linux, ~128 is windows.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#5Telnet to the port sometime establishes connectivity too.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#6You can use nmap for checking presence of the host, open ports and the OS machine running.
This tool has great documentation, see https://nmap.org/book/intro.html for more details
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#7> Further, the system that replies with a Destination host unreachable is the system which doesn’t have a path to the requested network - so you immediately know where to start looking.
No, that's "Destination net unreachable". Destination host unreachable means it didn't get an ARP response so it doesn't know the MAC address of the system with that IP.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#8Tip for tracerouters ... use mtr instead
brew install mtr
Try tapping 'd' twice to enable a stripchart
? for help
My traceroute [v0.95]
xxxxxxxx.local (172.16.0.2) -> news.ycombinator.com (50.1122022-07-27T23:37
Keys: Help Display mode Restart statistics Order of fields quit
Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. 172.16.0.1 0.0% 14 15.4 17.6 14.1 20.5 2.2
2. (waiting for reply)
3. 162.158.164.5 14.3% 14 34.4 71.1 16.5 145.4 47.3
4. 198.41.160.6 0.0% 14 32.9 36.0 30.2 43.9 3.4
5. 198.41.140.95 0.0% 14 61.9 45.0 35.3 64.7 9.8
6. 99.83.70.192 0.0% 14 40.7 36.7 33.1 49.6 4.4
7. 150.222.214.101 0.0% 14 36.6 41.3 34.7 58.1 6.2
8. 52.95.52.29 0.0% 14 41.6 40.0 35.1 51.1 4.2
9. (waiting for reply)Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#9You can use nmap for checking presence of the host, open ports and the OS machine running. This tool has great documentation, see https://nmap.org/book/intro.html for more details
nmap in movies:
Some times you can’t make out the text in films, but that is what Enhance is for.
Re: ICMP, Ping, and Traceroute – What I wish I was taught (2020)
#10You can use nmap for checking presence of the host, open ports and the OS machine running. This tool has great documentation, see https://nmap.org/book/intro.html for more details
And on the reverse side, OS fingerprinting by the packets you receive:
https://lcamtuf.coredump.cx/p0f3/