ping

The quickest test of "can I reach it?". Each reply shows its round trip time and the TTL it arrived with (64 minus the routers it crossed, for Linux senders). The summary gives loss and min/avg/max/mdev times. A line starting From <router> instead of a reply is an ICMP error: Destination Host Unreachable, Time to live exceeded, Frag needed. -s SIZE -M do sends large packets that may not be fragmented: the way to find an MTU problem.

ping command usage

ping [-c COUNT] [-i INTERVAL] [-W TIMEOUT] [-s SIZE] [-M do] [-t TTL] [-I CARD] [-q] ADDRESS

Options

-c 3

send 3 and stop (without it, ping runs until Ctrl+C)

-i 0.2

0.2 s between requests instead of 1 s

-W 2

wait at most 2 s for each reply

-s 1472

1472 bytes of data: with 28 bytes of headers, a 1500-byte packet

-M do

set don't-fragment: too big fails instead of being split

-t 1

start with TTL 1: the first router answers instead

-q

quiet: only the summary

-6

IPv6 (the same as ping6)

ping examples

ping -c3 10.0.1.2

Sends three echo requests to 10.0.1.2 and prints each reply and a summary.

ping -c5 -i0.2 -q 10.0.2.10

Sends five quick requests and prints only the loss and timing summary.

ping -c1 -W2 10.0.2.10

Sends one request and waits at most two seconds: a fast yes/no test.

ping -c2 -s 1472 -M do 10.0.2.10

Sends full 1500-byte packets that may not be fragmented, to test the path MTU.

ping -c1 -t1 10.0.2.10

Sends one request with TTL 1, so the first router answers with time exceeded.

ping -6 -c3 webServer.lab

Pings the server over IPv6.

ping 10.0.1.2

Pings until you press Ctrl-C, then prints the summary: on Linux it never stops by itself.

ping -I eth1 -c3 10.0.2.10

Sends from eth1 (or from an address, -I 10.0.1.50), to test one uplink of several.

ping -w 10 10.0.2.10

Stops after ten seconds whatever happens: a deadline, where -W is the wait for each reply.

ping -D -O 10.0.2.10

Stamps each line with the time and reports each request that got no reply, to log when an outage started and ended.

ping -f -c 1000 10.0.2.10

Floods 1000 requests as fast as replies come back ; the dots left on screen are the lost ones (needs root).

ping -4 -c3 webServer.lab

Pings the IPv4 address even when the name also has an IPv6 one.

ping -c3 fe80::1%eth0

Pings a link-local IPv6 address; %eth0 says which card's link it is on.

ping -c2 -M do -s 8972 10.0.2.10

Checks that jumbo frames pass: 8972 bytes of data plus 28 of headers make a 9000-byte packet.

ping -c1 -W1 10.0.2.10 > /dev/null && echo up || echo down

Turns ping's exit code into up or down, for a script: 0 means a reply came.

Reading the output

$ ping -c3 10.0.2.10
PING 10.0.2.10 (10.0.2.10) 56(84) bytes of data.
64 bytes from 10.0.2.10: icmp_seq=1 ttl=63 time=0.124 ms
64 bytes from 10.0.2.10: icmp_seq=2 ttl=63 time=0.127 ms
64 bytes from 10.0.2.10: icmp_seq=3 ttl=63 time=0.061 ms

--- 10.0.2.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2052ms
rtt min/avg/max/mdev = 0.061/0.104/0.127/0.030 ms

• ttl=63: the server sent it with 64, so one router is in between.
• icmp_seq: a gap in the numbers is a lost packet.
• 0% packet loss and avg: the two numbers to compare before and after a change. mdev is the jitter.
• From 10.0.1.2 … Destination Host Unreachable instead: that router could not deliver it. No line at all: silence, often a firewall that drops.

Pitfalls

• No reply does not mean down: many firewalls drop ICMP. Try the real service (curl, nc -zv) before deciding.
• Ping tests both directions at once: a missing route back looks exactly like a missing route there.
• ping: local error: message too long, mtu=1400: your own card's MTU is smaller than the packet; the packet never left.

Run it on real machines