alt.certification.mcse - what port does ping use?

Author

what port does ping use?

post@news.com

2003-07-31, 2:26 pm

What port does ping use? Does it use the port 80? On a company, I can browse
www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself though. What
does it tell?

kyfunguy

2003-07-31, 4:25 pm

I can ping www.yahoo.com... it's IP address lists as 216.109.118.65... why
are you trying to ping yahoo anyway..?

<post@news.com> wrote in message news:bgbjdj0gh5@drn.newsguy.com...
> What port does ping use? Does it use the port 80? On a company, I can
browse
> www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself though.
What
> does it tell?
>

The Oracle

2003-07-31, 5:25 pm

It tests that the domain name can be resolved to an IP address. If you run
an analyser on the "ping yahoo.com" you'll see a DNS message get sent to the
DNS server that will reply with the IP address of "yahoo.com" or any other
URL you type for that matter. The PC will then send an ICMP echo request
(ping) message directly to that IP address that has just been returned from
the DNS server. If "yahoo.com" is abl;e to respond to the ping request it
will return a ICMP echo reply to your PC or workstation. The path through
the internet that the ping request and ping reply take need not be the
same - "assymetrical routing". I am in the UK and if I ping microsoft.com,
the echo request could go via London, Toronto, Dallas, LA and San Jose. The
reply to the ping could go via San Jose, LA, Sydney, Kong Kong, Delhi,
London. It depends on the routing of the carriers between here and there.
This is a complete science in its own right and it's what makes the internet
actually work.

The ping mesage is part of the ICMP protocol. It does not use an IP port
number (in 99.999% of cases anyway). It is a complete protocol in its own
right (just like IP, IPX etc) that lives on top of a layer two topology like
ethernet, frame relay, PPP etc.

Search on cisco.com for some good articles on this type of thing.
Steve

<post@news.com> wrote in message news:bgbjdj0gh5@drn.newsguy.com...
> What port does ping use? Does it use the port 80? On a company, I can
browse
> www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself though.
What
> does it tell?
>

Don D $soon to be a MCSA$

2003-08-01, 12:26 am

PING uses ICMP echo requests, on port 7/tcp, covered in rfc 792.

<post@news.com> wrote in message news:bgbjdj0gh5@drn.newsguy.com...
> What port does ping use? Does it use the port 80? On a company, I can
browse
> www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself though.
What
> does it tell?
>

Simon Chang

2003-08-02, 9:25 am

No, your descriptions of "ping" are misleading and wrong.

Steve is correct is saying that "ping" does not use a "port" number as we
know it. A port is associated with a "socket" that lives on layer 4 (i.e.
the transport layer). You can't ping a specific port number as it is a
completely different protocol/transport type from TCP, UDP, GRE, etc.

However, Steve is wrong in saying that ICMP is "just like IP, IPX" and lives
on top of layer 2. ICMP is encapsulated by a regular IP header and lives on
top of layer 3. See Page 69 of "TCP/IP Illustrated, Volume 1" for more
information.

Don D is wrong when he refers to the "echo" facility as the ping service.
That is incorrect. The "echo" service/protocol simply echos back whatever
characters you send to it. It is one of the earliest "small servers"
protocol to be implemented. It has nothing to do with ping or ICMP. The
correct rfc that talks about the "echo" service, by the way, is rfc 862, not
RFC 792 as he had suggested. (Don D may have mistaken "echo" for ping and
just searched the list of TCP/UDP ports for anything resembling the idea of
a "return" or "response".)

"Don D (soon to be a MCSA)" <dondtus@no.spam.hotmail.com> wrote in message
news:xxlWa.54052$zy.34780@fed1read06...
> PING uses ICMP echo requests, on port 7/tcp, covered in rfc 792.
>
> <post@news.com> wrote in message news:bgbjdj0gh5@drn.newsguy.com...
> > What port does ping use? Does it use the port 80? On a company, I can
> browse
> > www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself
though.
> What
> > does it tell?
> >
>
>

Simon Chang

2003-08-02, 9:25 am

Gareth Church

2003-08-03, 9:25 am

"Simon Chang" <schang@quantumslipstream.net> wrote in message
news:3f2bafc7_4@news1.prserv.net...
> No, your descriptions of "ping" are misleading and wrong.
>
> Steve is correct is saying that "ping" does not use a "port" number as we
> know it. A port is associated with a "socket" that lives on layer 4 (i.e.
> the transport layer).

Layer 4 of the OSI model is the transport layer. But TCP/IP doesn't stick to
the OSI model - it predates it. Layer 4 of TCP/IPs model would be the
application layer.

> You can't ping a specific port number as it is a
> completely different protocol/transport type from TCP, UDP, GRE, etc.

That's right. Ports/sockets are used as a primitive way for applications to
talk across a network. ICMP (which the ping command uses) is designed to
work at a low level (it's used by routers to provide status information,
such as when it is being saturated by data) - not at the application level.

> However, Steve is wrong in saying that ICMP is "just like IP, IPX" and
lives
> on top of layer 2.

According to everything I've read on the subject ICMP does indeed reside in
layer 2 (Internet layer). As an example from Teach Yoursefl TCP/IP in 24
Hours - "The Internet Control Message Protocol is the third key protocol
that resides within the Internet layer". Internetwroking with Microsoft
TCP/IP in Microsoft Windows NT 4.0 (an old MCT book) also puts ICMP in the
Internet layer.

> ICMP is encapsulated by a regular IP header and lives on
> top of layer 3. See Page 69 of "TCP/IP Illustrated, Volume 1" for more
> information.

I don't have this book to check, but based on your incorrect assertions I
can only guess that it does not make the distinction between OSI and TCP/IPs
models clear.

> Don D is wrong when he refers to the "echo" facility as the ping service.
> That is incorrect. The "echo" service/protocol simply echos back whatever
> characters you send to it. It is one of the earliest "small servers"
> protocol to be implemented. It has nothing to do with ping or ICMP.

That isn't correct. They are indeed related. An ICMP message is made up of
four fields, one of which is a Type code. Two examples of the Type field are
Echo Reply (0), and Echo Request (8) [thyou can read this in rfc 792 - top
of page 14]. These two message types are what the ping command uses.

> The
> correct rfc that talks about the "echo" service, by the way, is rfc 862,
not
> rfc 792 as he had suggested. (Don D may have mistaken "echo" for ping and
> just searched the list of TCP/UDP ports for anything resembling the idea
of
> a "return" or "response".)

RFC 792 is indeed the rfc that talks about ICMP. The page
http://cnswww.cwru.edu/net/odds-ends/rfc/rfc863 lists a few RFC's, and has
792 listed under "Lower Layers" and 862 under "Other", along with high-level
protocols like FTP. From that I gather that the Echo Protocol is something
completely different from ICMP (and hence ping). That would make complete
sense, since rfc 862 talks about a port number (7) which would indicate it
was an application layer protocol.

Gareth

alvinsmith@broadviewnet.com

2003-08-09, 12:25 am

post@news.com wrote in message news:<bgbjdj0gh5@drn.newsguy.com>...
> What port does ping use? Does it use the port 80? On a company, I can browse
> www.yahoo.com, but I can't ping www.yahoo.com. It can ping itself though. What
> does it tell?

In answer to your question a lot of companies block ICMP (ping) in and
out of the firewall as a security measure.

Sparky

2003-08-20, 9:26 am

"Gareth Church" <gechurch@bigpond.com.au> wrote in message
news:ep7Xa.7925$bo1.6410@news-server.bigpond.net.au...
>
> According to everything I've read on the subject ICMP does indeed reside
in
> layer 2 (Internet layer). As an example from Teach Yoursefl TCP/IP in 24
> Hours - "The Internet Control Message Protocol is the third key protocol
> that resides within the Internet layer". Internetwroking with Microsoft
> TCP/IP in Microsoft Windows NT 4.0 (an old MCT book) also puts ICMP in the
> Internet layer.
>

Gentleman, Gentleman, I have been involved in protocol
design/implementation for over two decades (i.e., I am a system-level
software engineer). I have to say that most of you need to read/comprehend
the RFCs as they are protocol implementation guides (RFC 792 in the case of
ICMP). ICMP is not, repeat is not implemented on top of layer two. It is
implemented on top of layer three. It is not a true transport layer
protocol, but a layer three helper/maintenance protocol. ALL ICMP PACKETS
ARE ENCAPSULATED INSIDE OF IP PACKETS.

We have to remember that layer three is responsible for internetwork
routing. Without an internwork routing layer, ICMP packets would be
undeliverable beyond the same data link. There are two Internet protocols
that interface with the data link layer; namely, ARP and IP. IP uses ARP to
translate from IP address to MAC (data link) address. If the two IP
addresses are not on the same data link (this is detemined by "AND"-ing the
network mask with the destination IP address), the IP packed is sent to the
default router (gateway in IP terms), which is also ARPed.

>
> rfc 792 is indeed the rfc that talks about ICMP. The page
> http://cnswww.cwru.edu/net/odds-ends/rfc/rfc863 lists a few RFC's, and has
> 792 listed under "Lower Layers" and 862 under "Other", along with
high-level
> protocols like FTP. From that I gather that the Echo Protocol is something
> completely different from ICMP (and hence ping). That would make complete
> sense, since rfc 862 talks about a port number (7) which would indicate it
> was an application layer protocol.
>

There are eleven commonly used ICMP message types. Of these, "ping" uses
two; namely, "Echo" and "Echo Reply." A "ping" is basically a "hello,
are you alive?" ICMP request.

Furthermore, to clarify additional misunderstandings about the Internet
Protocol Stack, layer four is not the application layer. UDP and TCP
reside at layer four. UDP is a connectionless, packet-oriented protocol.
TCP is a connection-oriented, byte stream protocol. UDP is not really a
layer four protocol in all respects because it does not provide flow
control, segmentation et. al. The only thing that it basically provides
above and beyond IP is subaddressing on a IP node (via a "port number").
TCP is a true layer four protocol.

Additionally, while there is no clear delineation between the layers on
protocols above layer four in the Internet Protocol stack, DNS does provide
the name translation function of layer five (i.e., the session layer). XDR,
NDR, ASN.1, XML, MIME et. al. provide the data management/syntax translation
functionality and SSL provides the security functionality of layer six
(i.e., the presentation layer).

Gareth Church

2003-08-21, 10:29 am

"Sparky" <no.spam@wanted.you.fool.org> wrote in message
news:3f421559_2@newsfeed...
> > rfc 792 is indeed the rfc that talks about ICMP. The page
> > http://cnswww.cwru.edu/net/odds-ends/rfc/rfc863 lists a few RFC's, and
has
> > 792 listed under "Lower Layers" and 862 under "Other", along with
> high-level
> > protocols like FTP. From that I gather that the Echo Protocol is
something
> > completely different from ICMP (and hence ping). That would make
complete
> > sense, since rfc 862 talks about a port number (7) which would indicate
it
> > was an application layer protocol.
> >
>
> There are eleven commonly used ICMP message types. Of these, "ping" uses
> two; namely, "Echo" and "Echo Reply." A "ping" is basically a "hello,
> are you alive?" ICMP request.

We already know. You snipped the following from the post you are replying
to:

"An ICMP message is made up of four fields, one of which is a Type code. Two
examples of the Type field are Echo Reply (0), and Echo Request (8) [thyou
can read this in rfc 792 - top of page 14]. These two message types are what
the ping command uses."

> Furthermore, to clarify additional misunderstandings about the Internet
> Protocol Stack,

Additional?

> layer four is not the application layer.

TCP/IP doesn't map to the OSI model - it predates it. The TCP/IP model only
has 4 layers - the top of which is the application layer. (Again, I said
this in my previous post and you snipped it). I'm not saying you are wrong,
but you haven't provided any links to validate what you are saying. So, for
the meantime, I will continue believing all of the books I have read on the
subject which all clearly state that the TCP/IP model uses 4 layers.

I suppose since the OSI model is a reference, not an implementation, you
could argue that TCP/IP does map to the OSI model. That's not a very logical
view though, and even then the TCP/IP model still only uses 4 layers. It
doesn't magically gain layers. No matter how you look at it, layer four of
the TCP/IP model is the application layer.

> UDP and TCP
> reside at layer four. UDP is a connectionless, packet-oriented protocol.
> TCP is a connection-oriented, byte stream protocol. UDP is not really a
> layer four protocol in all respects because it does not provide flow
> control, segmentation et. al. The only thing that it basically provides
> above and beyond IP is subaddressing on a IP node (via a "port number").
> TCP is a true layer four protocol.

Seems you are talking about the transport layer. Yep, it's layer 4 in the
OSI model, but not in the TCP/IP model. Also, I wouldn't agree that UDP "is
not really a layer four protocol". The transport layer exists to implement
error checking and flow control. There's nothing to say that a protocol that
chooses not to implement very strong error checking etc is any less of a
protocol than one that does. UDP and TCP are just different. They are useful
in different circumstances. It's not a case of one being inferior to the
other.

> Additionally, while there is no clear delineation between the layers on
> protocols above layer four in the Internet Protocol stack, DNS does
provide
> the name translation function of layer five (i.e., the session layer).
XDR,
> NDR, ASN.1, XML, MIME et. al. provide the data management/syntax
translation
> functionality and SSL provides the security functionality of layer six
> (i.e., the presentation layer).

Layer 5, the session layer? Nope, doesn't exist in the TCP/IP model. Sounds
like you are talking about the OSI model again.

Sheesh. After that speil about how long you've been in the business and how
much you know, I would have expected you to realise that the TCP/IP and the
OSI models were different. This was taught in week 1 of my networking uni
course. It's that fundamental.

Gareth

Sparky

2003-08-22, 3:26 am

"Gareth Church" <gechurch@bigpond.com.au> wrote in message
news:X241b.50237$bo1.18675@news-server.bigpond.net.au...
>
>
> Sheesh. After that speil about how long you've been in the business and
how
> much you know, I would have expected you to realise that the TCP/IP and
the
> OSI models were different. This was taught in week 1 of my networking uni
> course. It's that fundamental.
>

The OSI model is most definitely a reference model, and, yes, it was defined
after the Internet Protocol Stack was created. However, most
protocol/communication device design work is performed using the OSI as a
reference; thus, MOST PROTOCOL/COMMUNICATION DEVICE DESIGN ENGINEERS MAP THE
INTERNET PROTOCOL STACK INTO THE OSI MODEL (i.e., a CISCO router is
referred to as layer three OSI Reference Model device and an Ethernet Switch
referred to as a layer two device, even if they are carrying Internet
Protocol Stack traffic) Why? Because the OSI model is both more granular
and the du jour standard! For instance, the TCP/IP model lumps the OSI
data link and physical layers into one layer; namely, the Network Interface
Layer. For the network technician, the TCP/IP model may be sufficient.
For the protocol design/implementation engineer, this level of granularity
is insufficient.

For example, most implementations of the Internet Protocol Stack can run on
top of 802.3/Ethernet II. However, Ethernet II and 802.3 are not exactly
the same network interface. Yes, they both share CSMA/CD media access
control. Yes, they both use Manchester signal encoding. Yes, they both
use a sixty-four bit preamble, a six octet destination address, and a six
octet source address. However, the next two bytes make a world of
difference in how the frame is parsed by the stack, and here is where one
must use the OSI reference model when implementing the Internet Protocol
Stack.

Have you ever wondered why 802.3 limits frame size to 1500 bytes? It is
because, in the Ethernet II specification, the two bytes that follow the
source address are a packet type field, not a length field, and the original
network layer protocol that ran on Ethernet (which was probably
around/before the time that you were soiling your diaper green); namely, XNS
IDP, had a protocol type of 600 hex, which just happens to be 1536 in
decimal (before you try to correct me, XNS had a five-layer model). Many
Internet Protocol Stack implementations still use Ethernet II frames (IP
packet type = 800 hex and ARP packet type = 806 hex); thus, the protocol
implementer must resort to the OSI model to document the implementation of
this portion of the stack because the TCP/IP stack is not granular enough.
The stack must be flexible enough to handle 800 hex Ethernet II frames and
802.3/802.2 LLC/SNAP frames. If the value in the thirteenth and
fourteenth octets of the frame is greater than or equal to 800 hex, then the
stack can just pass the contents of the data field of the frame up to IP.
However, if this value is less than or equal to 5DC hex (1500 decimal), then
the frame must be passed up to 802.2 LLC/SNAP (which is the top half of the
802.X data link layer), which will process the eight octet 802.2 LLC/SNAP
header and pass the remaining portion of the data field up to IP (that is,
if the protocol type in the SNAP header is either 800 hex or 806 hex).

P.S. BTW, there is actually a complete OSI protocol stack.

P.P.S. If you want to see that the mapping I outlined in my previous
posting is a commonly accepted practice, please visit the following URLs:

http://www.xinit.net/misc_tcpip_osi.shtml
http://www.cs.wcu.edu/~holliday/cware/Stack/Stack.html
http://ist.uwaterloo.ca/cn/Stats/extvol.html
http://www.securiteam.com/securitynews/6K00J1F2UI.html
http://www.cmi-net.com/store/cisco.asp
http://burks.brighton.ac.uk/burks/p...rnet/router.htm
http://sure.org.ru/docs/networks/cisco_ospf/chap01.html
http://www.geocities.com/ellis_craig_99/ccna.html
http://www.nichenetworks.com/psfold...p%20Outline.pdf

P.P.P.S. I dare you to find a router company that does not use the OSI
Reference Model nomenclature when describing their products.

P.P.P.P.S. If you ever want to pass CISCO's (or any other router company's
exams), you better start thinking in terms of the OSI Reference Model.

Sparky

2003-08-22, 8:25 am

"Sparky" <no.spam@wanted.you.fool.org> wrote in message
news:3f447264_3@newsfeed...

In the previous posting, the following sentance:

"If the value in the thirteenth and fourteenth octets of the frame is
greater than or equal to 800 hex, then the stack can just pass the contents
of the data field of the
frame up to IP. "

Should read:

"If the value in the thirteenth and fourteenth octets of the frame is equal
to 800 (or 806 hex), then the stack can just pass the contents of the data
field of the
frame up to IP. "

Sparky

2003-08-22, 10:27 am

Here is one more URL that defines the Internet Protocol Stack (a.k.a. the
Internet Protocol Suite) in OSI terms:

http://www.cisco.com/warp/public/535/4.html

As I said, all protocol/communication device design/implementation engineers
use the OSI model as the du jour standard. All state-of-the art networks
are referenced to the OSI model.

Gareth Church

2003-08-22, 10:27 am

"Sparky" <no.spam@wanted.you.fool.org> wrote in message
news:3f447264_3@newsfeed...
> > Sheesh. After that speil about how long you've been in the business and
> how
> > much you know, I would have expected you to realise that the TCP/IP and
> the
> > OSI models were different. This was taught in week 1 of my networking
uni
> > course. It's that fundamental.
> >
>
>
> The OSI model is most definitely a reference model, and, yes, it was
defined
> after the Internet Protocol Stack was created. However, most
> protocol/communication device design work is performed using the OSI as a
> reference;

Perform using it as a reference? No. It is sometimes convinient to think
about the TCP/IP stack in relation to the OSI model, but the actual
implementations of TCP/IP have nothing to do with OSI.

> thus, MOST PROTOCOL/COMMUNICATION DEVICE DESIGN ENGINEERS MAP THE
> INTERNET PROTOCOL STACK INTO THE OSI MODEL (i.e., a CISCO router is
> referred to as layer three OSI Reference Model device and an Ethernet
Switch
> referred to as a layer two device, even if they are carrying Internet
> Protocol Stack traffic) Why? Because the OSI model is both more
granular
> and the du jour standard! For instance, the TCP/IP model lumps the OSI
> data link and physical layers into one layer; namely, the Network
Interface
> Layer. For the network technician, the TCP/IP model may be sufficient.
> For the protocol design/implementation engineer, this level of granularity
> is insufficient.

I agree with all that. I still don't understand why you replied to my
original message though. I thought I made it quite clear that OSI and TCP/IP
were different in that post, and I thought whenever I mentioned a layer that
it was clear whether I was referring to OSI or TCP/IP. I just don't see why
you replied to that essentially repeating what I had already said - that
ping uses ICMP packets.

Gareth

Sparky

2003-08-22, 10:27 am

"Sparky" <no.spam@wanted.you.fool.org> wrote in message
news:3f44cde0$1_2@newsfeed...
>
> As I said, all protocol/communication device design/implementation
engineers
> use the OSI model as the du jour standard.
>
>

Should read:

"As I said, all protocol/communication device design/implementation
engineers
use the OSI model as the de jure standard."

Sponsored Links