Applications /

More on ping and traceroute

By Joel Snyder
Network World on Groupware and Messaging, 07/14/99

In my last newsletter, I discussed how to get ping and traceroute onto your desktop. Now, let's fill in a few details.

First, a word about ping. The bottom line is: ping is dead. Packet monkeys around the Internet have discovered how to do denial-of-service attacks by downloading a variety of hacking tools and letting them loose. One of many problems with the way that the Internet works is that you can use third parties to amplify certain kinds of denial-of-service attacks by careful use of broadcast and multicast addresses. Send an IP echo request ICMP packet (a "ping" packet) to a network's broadcast address with a forged source address of the host you want to down, and every host on that network will respond to the ping. Easy way to take almost any site you want off the air.

Network managers are starting to protect themselves against this problem by having their upstream ISP filter ICMP echo requests, which makes ping essentially useless for large parts of the Internet. The only tool left for measuring network round-trip delay is traceroute.

In addition to having traceroute on your desktop, it helps a lot to have a copy of traceroute running at the other end, wherever that may be. For that, you'll need either a shell account on a system that has traceroute or, more commonly today, access to a network traceroute server to bring the information of traceroute to your friendly Web browser.

A network traceroute server is generally a small CGI script wrapped around the stock traceroute program. (Some ISPs, such as Opus One, maintain a more sophisticated traceroute program; go to www.opus1.com/www/traceroute.html to see a different view.) The benefit of traceroute servers is that you can see what the route is not only from your workstation to the destination, but also from the destination to your PC. All good ISPs run traceroute servers to help diagnose routing problems. If your ISP doesn't have one prominently displayed, then call technical support and find out where they've hidden it. If you have your own corporate Internet connection, you will want to put up a quick traceroute server yourself, since the view of routing from your company may be very different from your ISP (see www.traceroute.org/ for a pointer to the source code for a traceroute gateway).

If you are just curious as to what a traceroute gateway looks like from some third party, you can get a nice list of traceroute gateways at a new page maintained by traceroute.org or an older set kept up by Boardwatch magazine at boardwatch.internet.com/traceroute.html (you can also read the well written traceroute tutorial that Boardwatch has provided).

The next step beyond traceroute gateways is Internet looking glasses. These are scripts that can reach into a router and extract information about routing. If you don't have some passing familiarity with BGP, then most looking glasses will be Greek to you. If you've figured out how BGP is used to spread routing information across the Internet, then start at nitrous.digex.net/ for a good look at BGP information in key core routers at the backbone of the Internet. An excellent long list of looking glasses is also maintained at www.traceroute.org.

With these tools, you can now answer the simple question: how far am I from my mail system? And with that answer, you can decide how to read your mail. Let's take that up next week.