51
In general, blocking ICMP packets, even just ECHO_REQUEST packets, is not desirable. You lose a valuable source of information about your network and inconvenience users who may have a
legitimate need for these messages. This is often done as a stopgap measure in the absence of a more comprehensive approach to security.
Interestingly, even if ICMP packets are being blocked, you can still use ping to see if a host on the local subnet is up. Simply clear the ARP table typically arp -ad, ping the device, and then examine
the ARP table. If the device has been added to the ARP table, it is up and responding.
One final note about ping. It should be obvious, but ping checks only connectivity, not the functionality of the end device. During some network changes, I once used ping to check to see if a
networked printer had been reconnected yet. When I was finally able to ping the device, I sent a job to the printer. However, my system kept reporting that the job hadnt printed. I eventually got up and
walked down the hall to the printer to see what was wrong. It had been reconnected to the network, but someone had left it offline. Be warned, it is very easy to read too much into a successful ping.
3.3.4 Alternatives to ping
Variants to ping fall into two general categories, those that add to pings functionality and those that are alternatives to ping. An example of the first is fping, and an example of the second is echoping.
3.3.4.1 fping
Written by Roland Schemers of Stanford University, fping extends ping to support multiple hosts in parallel. Typical output is shown in this example:
bsd1 fping 172.16.2.10 172.16.2.11 172.16.2.12 172.16.2.13 172.16.2.14 172.16.2.13 is alive
172.16.2.10 is alive 172.16.2.12 is alive
172.16.2.14 is unreachable 172.16.2.11 is unreachable
Notice that five hosts are being probed at the same time and that the results are reported in the order replies are received.
This works the same way ping works, through sending and receiving ICMP messages. It is primarily designed to be used with files. Several command-line options are available, including the -f option for
reading a list of devices to probe from a file and the -u option used to print only those systems that are unreachable. For example:
bsd1 fping -u 172.16.2.10 172.16.2.11 172.16.2.12 172.16.2.13 172.16.2.14 172.16.2.14
172.16.2.11
The utility of this form in a script should be self-evident.
3.3.4.2 echoping
Several tools similar to ping dont use ICMP ECHO_REQUEST and ECHO_REPLY packets. These may provide an alternative to ping in some contexts.
TE AM
FL Y
Team-Fly
®
52
One such program is echoping. It is very similar to ping. It works by sending packets to one of several services that may be offered over TCP and UDP—ECHO, DISCARD, CHARGEN, and HTTP.
Particularly useful when ICMP messages are being blocked, echoping may work where ping fails.
If none of these services is available, echoping cannot be used. Unfortunately, ECHO and CHARGEN have been used in the Fraggle denial of service attacks. By sending the output from CHARGEN a
character-generation protocol to ECHO, the network can be flooded. Consequently, many operating systems are now shipped with these services disabled. Thus, the program may not be as useful as ping.
With Unix, these services are controlled by inetd and could be enabled if desired and if you have access to the destination machine. But these services have limited value, and you are probably better
off disabling them.
In this example, I have previously enabled ECHO on lnx1:
bsd1 echoping -v lnx1 This is echoping, version 2.2.0.
Trying to connect to internet address 205.153.61.177 to transmit 256 bytes... Connected...
Sent 256 bytes... 256 bytes read from server.
Checked Elapsed time: 0.004488 seconds
This provides basically the same information as ping. The -v option simply provides a few more details. The program defaults to TCP and ECHO. Command-line options allow UDP packet or the
other services to be selected.
When ping was first introduced in this chapter, we saw that www.microsoft.com could not be reached by ping. Nor can it be reached using echoping in its default mode. But, as a web server, port 80 should
be available. This is in fact the case:
bsd1 echoping -v -h ms.htm www.microsoft.com:80 This is echoping, version 2.2.0.
Trying to connect to internet address 207.46.130.14 port 80 to transmit 100 bytes...
Connected... Sent 100 bytes...
2830 bytes read from server. Elapsed time: 0.269319 seconds
Clearly, Microsoft is blocking ICMP packets. In this example, we could just as easily have turned to our web browser. Sometimes, however, this is not the case.
An obvious question is Why would you need such a tool? If you have been denied access to a network, should you be using such probes? On the other hand, if you are responsible for the security
of a network, you may want to test your configuration. What can users outside your network discover about your network? If this is the case, youll need these tools to test your network.
3.3.4.3 arping
