Monitoring by ICMP protocol

Main > Company news > Monitoring by ICMP protocol

Monitoring by ICMP protocol


Monitoring by ICMP protocol

The most basic and easiest way to check service availability is the icmp protocol.
ICMP (English Internet Control Message Protocol) is a network protocol included in the TCP / IP protocol stack. ICMP is mainly used to send messages about errors and other exceptional situations that occurred during data transmission, for example, the requested service is not available, or the host or router does not respond. Also, some service functions are assigned to ICMP.
To use testing icmp messages use the utilities icmp, traceroute, mtr and others.

Example of how ping works:

 [~]# ping -c 5 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=119 time=5.03 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=119 time=5.06 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=119 time=5.04 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=119 time=5.04 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=119 time=5.04 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4004ms
rtt min/avg/max/mdev = 5.033/5.046/5.068/0.090 ms
 [~]# 
 

And here is how the result is seen when viewing packages

# tcpdump -ni XXX icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on XXX, link-type EN10MB (Ethernet), capture size 262144 bytes
20:38:32.647842 IP 192.168.1.100 > 8.8.8.8: ICMP echo request, id 5, seq 1, length 64
20:38:32.663768 IP 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 5, seq 1, length 64
20:38:33.648884 IP 192.168.1.100 > 8.8.8.8: ICMP echo request, id 5, seq 2, length 64
20:38:33.664615 IP 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 5, seq 2, length 64
20:38:34.650747 IP 192.168.1.100 > 8.8.8.8: ICMP echo request, id 5, seq 3, length 64
20:38:34.666730 IP 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 5, seq 3, length 64
20:38:35.651841 IP 192.168.1.100 > 8.8.8.8: ICMP echo request, id 5, seq 4, length 64
20:38:35.667644 IP 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 5, seq 4, length 64
20:38:36.653116 IP 192.168.1.100 > 8.8.8.8: ICMP echo request, id 5, seq 5, length 64
20:38:36.669792 IP 8.8.8.8 > 192.168.1.100: ICMP echo reply, id 5, seq 5, length 64

The main possible codes for ICMP messages:

  • echo reply (0) - echo reply (echo reply, ping)

  • destination unreachable (3) - destination unreachable / destination port unreachable (destination unreachable). Code 3/4 notifies about the need to fragment the message, the sender receives it, changes his MSS to an even smaller one.

  • source quench (4) - source quench (suppress the source, please send packets more slowly)

  • redirect (5) - redirect (redirect)

  • echo request (8) - echo request (echo request, ping)

  • time-to-live exceeded (11) - time-to-live exceeded (expired packet)

  • IP header bad (12) - IP header bad (invalid IP packet header)




This way, we can track problems over the network, persistent or emerging. It is worth paying attention to the response time, no losses, the response time should be stable. Our monitoring not only keeps track of the object raised or disappeared, but also the response time and draws a graph based on the result. So it will be convenient to understand the situation and make decisions on it.

You can also use our online tools and look at the response time for pings and traces to your hosts from different parts of the world. The response time is especially critical for game servers. Keep important parameters under control.

Comments

Subscription

Subscribe to our newsletter to stay updated.

Social networks