Using Ping Feature More Effectively

Ping is one of the network troubleshooting technique that I can't go without these days.  In this post, I'll show you how to take advantage of all the extras that you don't have in the Command Window.  

• Ping Multiple Hosts: Press F1 to bring up the Add Host Address dialog.  Enter hosts/IP addresses which can be separated by space, comma, semi-colon, tab or a line feed.
• Reduce/Increase # of Rows Displayed For Ping Result: By default, Pinkie will show you 4 lines of ping results.  This can fill up the window pretty quick if you ping multiple hosts at the same time.  To reduce the # of rows, press F3 or increase it by F4.
• Check Ping Statistics For a Host: Select a host by clicking on it, the status bar at the bottom will change to show the ping statistics for the selected host which includes packets sent/received, lost count & percentage, last ping RTT along with Min, Max & Avg RTTs.
• Start/Stop a Ping: Right click on the host you want to start/stop pinging, select Ping first menu item in the context menu will change to Start/Stop as appropriate.  Clicking on it will stop a ping in progress or start it if it's not started yet.
• Reset Ping Statistics: Right click on a host you want to reset statistics, select Ping then click on Reset Statistics.
• Copy Ping Results: When troubleshooting network or server issues, you might have the need to send the ping result to someone.  This can be done by simply right click on the host and select Copy Result to Clipboard. then paste it to an email or wherever you wish.
• Logging Ping Results to Disk: If you wish to log ping results to a file to analyze later or send it to someone else, right click on the host, select Ping then in the context menu, click on Start Logging or Stop Logging as appropriate.  By default, the ping results will be saved in C:\Users\[username]\Documents\ipUptime.net\Pinkie_Logs.  You can change this path in the Settings menu.

That's not all all the extras that comes with the Ping functionality in Pinkie but it will definitely make you like and use Pinkie more (or shy away from the Command Prompt more).

If you can come up with a better way to use Ping or wish to have enhancements added to it, please let me know.  And last but not least, if you haven't used Pinkie yet, give it a try, you might like it.

Earlier this week, I released a suite of Windows network troubleshooting utilities called Pinkie through a website named ipUptime.net.

Everything went well. The public seems to welcome it and as I monitor the statistics for the site as well as the download counts from other download sites, I realized that something is wrong with my site statistics; the numbers don't match up and my number came up short.

As I found out, if people download the Pinkie through the link on my site then the download count is incremented. But if they had download it from other sites, using the URL I had published then the download is not accounted for.

Changing the published URL for all other sites will be time consuming so I was looking for a better solution to the issue. Then I remember ASP.net 2.0 supports URL Mappings. So by using URL Mappings, within a minute or two, my problem is solved.

Here's the syntax for URL Mappings:

<urlmappings>
<add url="~/newurl.aspx" mappedurl="~/oldURL.aspx"></add>
</urlmappings>

Best use for URL Mappings are for shortening long, hard to remember URL to something short & easy to remember or in my case, correct a mistake and save time.

Add Redundancy With Backup Command

You can add redundancy to your network and make you network more resilient with the Backup command. What this command does is specify an interface which will act as a back up in case the primary interface fails.

Let's take a look at the following configurations:

On RouterA:

Configure terminal
Interface f0/0
Ip address 192.168.1.1 255.255.255.0
no shutdown
Interface f0/1
Ip address 192.168.2.1 255.255.255.0
no shutdown
Backup interface f0/0
Exit
Router eigrp 20
network 192.168.1.0
network 192.168.2.0

On RouterB:

Configure terminal
Interface f0/0
Ip address 192.168.2.2 255.255.255.0
no shutdown
Interface f0/1
Ip address 192.168.2.2 255.255.255.0
no shutdown
Backup interface f0/0
Interface loop 0
Ip add 192.168.8.1 255.255.255.0
Exit
Router eigrp 20
network 192.168.1.0
network 192.168.2.0
network 192.168.8.0

With these configurations loaded, both Fa0/1's will change to up/up while Fa0/0's will go into standby mode and monitor the activities on Fa0/1. In the event that Fa0/1 goes down, Fa0/0 will switch to active mode and establish neighbor relationship with the connected interface and complete the failover.

To verify this, from RouterA you can ping 192.168.8.1 with the repeat parameter:

Ping 192.168.8.1 repeat 10000

This command will ping 192.168.8.1 10k times. While it's pinging, unplug the cable to Fa0/1. you will see that the link go down, the ping will fail and then within seconds Fa0/0 will be up and resume the active role and the pinging will resume as nothing has happened. If the link on Fa0/1 becomes active again, Fa0/0 will switch back to standby mode.

This is a quick and easy way to add redundancy to your network. There are other techniques that you can use to add redundancy to your network to include both layer 2 and layer 3 redundancies which I will discuss at another opportunity.

ICMP - Pinging Server 2008

One of the most common ways for an administrator to see if a particular server is up or not is to send an ICMP package to the server or to Ping it. This is also called an Echo Request.

Windows Server 2008 disable this Echo Request by default. Here's how you can turn this on:

1. Open Server Manager
2. Expand Configuration section
3. Expand Windows Firewall with Advanced Security (OK, Microsoft, is there a Basic one???)
4. Click on Inbound Rules
5. In the middle pane, scroll down and find "File and Printer Sharing (Echo Request - ICMPvX-in)" where the X stands for the IP version number
6. Right click it and select Enable
7. If you want to edit advanced options then right click it and select Properties option instead

If you are running the core version, you can accomplish the same thing by issuing the netsh command:

netsh firewall set icmpsetting 8

Cisco Switch - TFTP IOS Upgrade

Update, Copy, Backup, Restore IOS and startup-config are pretty much done in the same manner. First, you've got to configure the switch and the PC to talk then run the TFTP or FTP server and start the copy process.

Let's walk though how you can update Cisco IOS on a 6500.

Router> enable
Router# configure terminal
Router(config)# interface gig 9/1
Router(config-int)# switchport
Router(config-int)# switchport mode access
Router(config-int)# switchport access vlan 1
Router(config-int)# no shutdown
Router(config-int)# exit

At this point, we have turn port 9/1 into a layer 2 port on vlan 1. Now we need to assign an ip address to this default vlan so we can communicate to it.

Router(config)# interface vlan 1
Router(config-int)# ip address 10.10.10.1 255.255.255.0
Router(config-int)# no shutdown
Router(config-int)# exit

The next thing we need to do is to configure the network adapter on your PC or laptop and give it an address that's on the same network as the switch. In this case, I set it to be 10.10.10.2 255.255.255.0.

Plug in the cable from the PC to the port we just configured; and to make sure the PC can talk to the 6500 we can try pinging it:

Router(config)# do ping 10.10.10.2

If you have a successful ping reply then you should be good to go. Launch the TFTP server and start the copy process. To copy from data from TFTP server to the switch use:

Router# copy tftp: disk0:

After you issue either of this command, you will be prompted for the FTFP server address and filename. Enter 10.10.10.2 and the filename you want to copy, then confirm it to start the copy process.

And to copy data from flash to FTFP server use the command:

Router# copy disk0: tftp:

If you are copying a rather large file then you should use FTP instead of TFTP and issue the command:

Router# copy FTP: Disk0:

I have run into some issue while moving a large file to the Cisco 6509. See this blog for more details.

ProCurve Switch - TFTP Flash Update

To update the IOS on the HP's ProCurve switches you first need to configure an access port so it can communicate to the TFTP Server.

ProCurve Switch 3500yl-48G> enable
ProCurve Switch 3500yl-48G# configure terminal
ProCurve Switch 3500yl-48G(config)# vlan 1
ProCurve Switch 3500yl-48G(vlan-1)# ip address 10.10.10.1/24
ProCurve Switch 3500yl-48G(vlan-1)# exit

Next, you will need to configure the network adapter on your PC or laptop and give it an address that's on the same network as the switch. In this case, I set it to be 10.10.10.2 255.255.255.0.

Then the next step is to connect your machine to the switch; plug a cable from your laptop or PC to the switch. And just to make sure that the data can travel from one end to another, we'll go ahead and try to send a ping to the server:

ProCurve Switch 3500yl-48G# ping 10.10.10.2

If the ping is successful, you need to launch your TFTP Server, then you can go ahead and update the flash by issuing the copy command and pass to it the server address and the filename:

ProCurve Switch 3500yl-48G# copy tftp flash 10.10.10.2 k_12_02.swi

And if you need to update the secondary flash, then issue this command:

ProCurve Switch 3500yl-48G# copy tftp flash 10.10.10.2 k_12_02.swi secondary

I make a habit of using scripts to make the whole process easier to manage and make the update faster so here's the entire script:

enable
configure terminal
vlan 1
no ip add
ip address 10.10.10.1/24
exit
ping 10.10.10.2
copy tftp flash 10.10.10.2 k_12_02.swi
y
copy tftp flash 10.10.10.2 k_12_02.swi secondary
y

Note: If you use this script, make sure that you update the ip address and change the filename.

Programmatically Ping A Networking Device

I would say Ping is one of the most popular software tool used to troubleshoot network issue. When a networking device or server goes down, one of the first things network engineers or system admininistrator do is try to ping it and see if it can be reached.

This blog will show you two ways to ping a device so you can integrate the ping feature into your application.

The first and easiest way to issue a ping command is to call the Ping method in the My.Computer.Network class:

If my.Computer.Network.Ping("www.google.com") Then
MsgBox("device up")
Else
MsgBox("device down")
End If

The drawback of this method is that it only gives you a boolean as the result to indicate whether the device is up or down.

The second way is to call the Ping.Send() method in the System.Net.NetworkInformation namespace which returns a PingReply through which you could get more detailed information about the ping:

Dim myPing As New System.Net.NetworkInformation.Ping
Dim PR As System.Net.NetworkInformation.PingReply
PR = myPing.Send("www.yahoo.com")
If PR.Status = IPStatus.Success Then
MsgBox("Reply from " & PR.Address.ToString & ": BYTES=" & PR.Buffer.Length & " TIME<" & PR.RoundtripTime & "ms TTL=" & PR.Options.Ttl)
Else
MsgBox(PR.Status.ToString)
End If

There you have it. Two ways of pinging a networking device. I recommend that you further study the PingReply object to get more information from the ping reply.

Ping Flood Attack

A ping flood is a simple Denial of Service (DoS) attack where the attacker sends a massive number of ICMP Echo Request (ping) packets to the victim in hope of overwhelming the victim and consuming both outgoing and incoming bandwidth on the victim's network. An effective attack could render the victim's network useless.

This type of attack only succeeds if the attacker has more available bandwidth than the victim (like a T3 versus and DSL line) which is very unlikely. To get around this, the attacker normally use an army of computers (a network of computers that attacker has control called zombies or bots) numbered in the hundreds or thousands to attack the victim with their combined bandwidth power.

Defense Your Network

To reduce the effects of ping flood attack, one can use a firewall to inspect the traffic and filter ICMP Echo Request packets. However, doing this can also have its side effects such that it prevents legistimate users from pinging their hosts. For this reason, we can use firewall to authorize ICMP Echo Request packets from legistimate source only.