CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Networking / ping

ping

Check if a host answers and how fast

Beginnernetworkicmpdiagnostics

ping sends ICMP echo requests to a host and times the replies. It answers three questions in seconds: does the name resolve, is the host reachable at the IP layer, and how much latency and packet loss is on the path.

Syntaxping [-c COUNT] [-i INTERVAL] [-W TIMEOUT] [-s SIZE] [-M do] [-4|-6] HOST

Watch it run

A colleague says the site is slow. Before anything else, check the host answers and what normal latency looks like.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
ping -c 4 example.com

The name resolved, four echo requests went out one second apart and four replies came back. Latency is under 2 ms and steady, so the network path is not the problem.

Anatomy of a command

$
commandping

Sends ICMP Echo Request packets and prints one line per Echo Reply it gets back.

How it works

ping first resolves the name with getaddrinfo (the same NSS path every program uses: /etc/hosts, then DNS). It then opens an ICMP socket: an unprivileged ICMP datagram socket where net.ipv4.ping_group_range allows it (the default on Ubuntu), otherwise a raw socket, which needs CAP_NET_RAW. Each packet is an ICMP Echo Request (type 8) carrying an identifier, a sequence number and a timestamp in 56 bytes of payload: 64 bytes of ICMP, 84 with the IP header. The target's kernel answers with an Echo Reply (type 0) without involving any application. ping matches replies by sequence number, computes the round-trip time from the timestamp and prints the TTL from the reply's IP header. Exit status is 0 if any reply came back, 1 if none did, 2 on other errors such as a name that doesn't resolve. No reply does not prove the host is down: firewalls and cloud security groups often drop ICMP.

Options you'll actually use

-c NSend N packets then stop and print the summary
-i SECInterval between packets (default 1 s; under 0.2 s needs root)
-W SECHow long to wait for each reply
-w SECDeadline: stop after SEC seconds whatever happened
-qQuiet: print only the start line and the summary
-s BYTESPayload size (default 56, giving 84-byte IP packets)
-M doSet Don't Fragment, to probe the path MTU
-t TTLSet the IP time-to-live of outgoing packets
-4 / -6Force IPv4 or IPv6
-nNumeric output, no reverse DNS lookups of reply addresses
-DPrefix each line with a Unix timestamp (good for long captures)
-I IFACESend from a specific interface or source address

Common mistakes

"ping times out, so the server is down"

Many networks and every default cloud security group drop ICMP. The host can be perfectly healthy and serving traffic.

nc -zv -w 2 host 443 # test the port the app really uses
ping example.com:8080

ping has no ports; ICMP is a layer-3 protocol. The colon makes it a hostname that won't resolve.

nc -zv example.com 8080 # or curl -I http://example.com:8080
Running ping in a script without -c

On Linux ping runs forever by default, so the script never continues.

ping -c 3 -W 1 host
Judging a link by one fast reply

One packet says nothing about loss or jitter, which are what make applications time out.

ping -c 100 -i 0.2 -q host # read loss % and mdev

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Ping the loopback address 127.0.0.1 exactly 3 times.

  2. 2

    Ping localhost 20 times, 0.2 seconds apart, and print only the summary.

  3. 3

    Write a one-liner that prints OK if 127.0.0.1 answers one ping within 1 second, and FAIL otherwise.

  4. 4

    Ping a name that doesn't exist (nosuchhost.invalid) and print ping's exit code. What does it mean?

Related commands

tracerouteTrace the routers between you and a hostdigQuery DNS and read the full answerncTest ports and move raw bytes over TCP/UDPipShow and change interfaces, addresses and routes
PreviousddNexttraceroute
Linux / Networking / ping

ping

Check if a host answers and how fast

Beginnernetworkicmpdiagnostics

ping sends ICMP echo requests to a host and times the replies. It answers three questions in seconds: does the name resolve, is the host reachable at the IP layer, and how much latency and packet loss is on the path.

Syntaxping [-c COUNT] [-i INTERVAL] [-W TIMEOUT] [-s SIZE] [-M do] [-4|-6] HOST

Watch it run

A colleague says the site is slow. Before anything else, check the host answers and what normal latency looks like.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
ping -c 4 example.com

The name resolved, four echo requests went out one second apart and four replies came back. Latency is under 2 ms and steady, so the network path is not the problem.

Anatomy of a command

$
commandping

Sends ICMP Echo Request packets and prints one line per Echo Reply it gets back.

How it works

ping first resolves the name with getaddrinfo (the same NSS path every program uses: /etc/hosts, then DNS). It then opens an ICMP socket: an unprivileged ICMP datagram socket where net.ipv4.ping_group_range allows it (the default on Ubuntu), otherwise a raw socket, which needs CAP_NET_RAW. Each packet is an ICMP Echo Request (type 8) carrying an identifier, a sequence number and a timestamp in 56 bytes of payload: 64 bytes of ICMP, 84 with the IP header. The target's kernel answers with an Echo Reply (type 0) without involving any application. ping matches replies by sequence number, computes the round-trip time from the timestamp and prints the TTL from the reply's IP header. Exit status is 0 if any reply came back, 1 if none did, 2 on other errors such as a name that doesn't resolve. No reply does not prove the host is down: firewalls and cloud security groups often drop ICMP.

Options you'll actually use

-c NSend N packets then stop and print the summary
-i SECInterval between packets (default 1 s; under 0.2 s needs root)
-W SECHow long to wait for each reply
-w SECDeadline: stop after SEC seconds whatever happened
-qQuiet: print only the start line and the summary
-s BYTESPayload size (default 56, giving 84-byte IP packets)
-M doSet Don't Fragment, to probe the path MTU
-t TTLSet the IP time-to-live of outgoing packets
-4 / -6Force IPv4 or IPv6
-nNumeric output, no reverse DNS lookups of reply addresses
-DPrefix each line with a Unix timestamp (good for long captures)
-I IFACESend from a specific interface or source address

Common mistakes

"ping times out, so the server is down"

Many networks and every default cloud security group drop ICMP. The host can be perfectly healthy and serving traffic.

nc -zv -w 2 host 443 # test the port the app really uses
ping example.com:8080

ping has no ports; ICMP is a layer-3 protocol. The colon makes it a hostname that won't resolve.

nc -zv example.com 8080 # or curl -I http://example.com:8080
Running ping in a script without -c

On Linux ping runs forever by default, so the script never continues.

ping -c 3 -W 1 host
Judging a link by one fast reply

One packet says nothing about loss or jitter, which are what make applications time out.

ping -c 100 -i 0.2 -q host # read loss % and mdev

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Ping the loopback address 127.0.0.1 exactly 3 times.

  2. 2

    Ping localhost 20 times, 0.2 seconds apart, and print only the summary.

  3. 3

    Write a one-liner that prints OK if 127.0.0.1 answers one ping within 1 second, and FAIL otherwise.

  4. 4

    Ping a name that doesn't exist (nosuchhost.invalid) and print ping's exit code. What does it mean?

Related commands

tracerouteTrace the routers between you and a hostdigQuery DNS and read the full answerncTest ports and move raw bytes over TCP/UDPipShow and change interfaces, addresses and routes
PreviousddNexttraceroute