The two most employed tools, and virtually always the first used to diagnose a network dilemma are trace route and Ping Test. The outcomes they return are nonetheless most typically misunderstood or interpreted in a way that results in an incorrect conclusion.
Let’s take the ping utility particularly. The prevalent mistake that is made is the fact that whatever the ping result is, is as a result of the target of the ping. By way of example, if there is no ping response; conclude that the web site is down. Or if there’s packet loss or long return times, conclude that it can be due to some challenge using the target address. Although each those outcomes could be the case, far additional typically than not, they’re completely the wrong conclusions to draw.
The prevalent causes of this misinterpretation are:
1. Ping sends a packet towards the destination address that typically will traverse several other network points to obtain there. An issue at any one of those points will cause a non-response towards the ping query
2. In a lot of situations internet websites along with other servers sit behind firewalls, and a lot of, if not most, firewalls block ping packets. So while web targeted traffic might reach the web site, ping packets may possibly not.
3. The ping packet has a source (the system initiating the ping) as well as a destination, it may possibly be that the source doesn’t have a right route path to the destination, or that the destination does not have a correct return route path to the source. This could possibly be due to particular firewall rules, an error inside the route tables ‘somewhere’ along the data path, or perhaps a distinct routing policy deliberately put in location to block access.
The traceroute command may be utilized to help detect if 1. or three. are the cause of the problem, which has its own issues, but more on that later. A positive result from either telnet and tcptraceroute will conclusively rule out 2. as a feasible case.
Telnet can be utilized to open a connection any any port, not just the telnet default port. A productive telnet connection where ping has failed is proof positive that a firewall is preventing access to ping packets.
Yet another prevalent error employing ping is that the results of just a couple of ping tests are indicative of the condition of a data path. It may possibly be true, but such a conclusion can only be relied upon over a statistically meaningful sample size. Also, to be genuinely accurate, the distribution of packets responses outside the acceptable level demands to be identified.
For example, as single Ping Speed Test of 4 packets where 1 packet is dropped, can’t, in any meaningful way, be employed to conclude that there is 25% packet loss on that circuit. Ten thousand ping tests, over many hours where there is say 5% lost has far more meaning; however take into account if the test was completed over 24 hours, and for one hour the target web site was down. The 100% loss during that hour looks like a general 5% packet loss over 24 hours.
It really is consequently essential to review the record of the ping test and see if the distribution of any packet loss is standard or confined to a distinct period, prior to a real conclusion could be drawn.
A third common error is that the trigger whatever is result is gained is as a result of the target web-site. As an example, say 5% packet loss was located when pinging 3com.com, this by no indicates indicates that the problem lays with that internet site, rather, the problem could possibly be with any of the points along the data path to that website, inclusive the source (my own laptop).
You may clearly see the number of hops the data should traverse. In this case there is certainly no evidence of any dilemma along the data path.
It could be reasonable to conclude that there was some significant problem in between hop 6 and hop 7 that’s causing the ping test to return its lousy result.
To conclude, we can see that ping:
1. Is a helpful tool to indicate where a problem might be
2. Ought to be utilized in combination with other tests to eradicate false positives
3. Should not be utilized for smaller, isolated tests
4. Is usually a very good indicator of difficulties over sadistically meaningful sample sizes