Ping命令及TTL值介绍 Purpose: This chapter reviews the physical layer and describes how to cable various network devices. Timing: This chapter takes approximately 1 hour to present. Note: This section has a cabling laboratory exercise at the end. Contents: Objectives—This section explains what the student will be able to do at the end of this chapter. TCP/IP Overview—This section describes the TCP/IP protocol stack. TCP/IP Application Layer Overview—This section describes the application protocols. TCP/IP Transport Layer Overview—This section describes TCP and UDP. TCP/IP Internet Layer Overview—This section describes IP and other Internet layer protocols. TCP/IP Address Overview—This section describes IP addressing. Configuring IP Addresses—This section describes how to address an IOS device with IP Interconnecting Networks—This section describes how to interconnect separate VLANs and WANs With TCP/IP. Written Exercise—This section has students work with IP addresses in binary format.

Ping命令概述 Ping程序实际就是发送一个ICMP回显请求报文给目的主机，并等待回显的ICMP应答。然后打印出回显的报文。Ping不通一个地址，并不一定表示这个IP不存在或者没有连接在网络上，因为对方主机可能做了限制，比如安装了防火墙，因此Ping不通并不表示不能使用FTP或者TELNET连接。

Ping的目的 Ping主机的IP地址—检验本地主机的TCPIIP地址配置

Ping常用参数介绍 ping [-t] [-a] [-n count] [-l length] [-f] [-i ttl] [-v tos] [-r count] [-s count] [[-j computer-list] | [-k computer-list]] [-w timeout] destination-list -t ping 指定的计算机直到中断。ctrl+c停止 -a 将地址解析为计算机名 -n count 发送 count 指定的 echo 数据包数。默认值为 4 -i ttl 将“生存时间”字段设置为 ttl 指定的值 -l length 发送包含由 length 指定的数据量的 echo 数据 包。默认为 32 字节；最大值是 65,527

ping -a www.google.com Pinging www.l.google.com [64.233.189.104] with 32 bytes of data: Reply from 64.233.189.104: bytes=32 time=69ms TTL=244 Reply from 64.233.189.104: bytes=32 time=78ms TTL=244 Reply from 64.233.189.104: bytes=32 time=77ms TTL=244 Ping statistics for 64.233.189.104: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 69ms, Maximum = 78ms, Average = 75ms

ping www.163.com -t -l 10000 Pinging www.cache.gslb.netease.com [61.135.253.16] with 10000 bytes of data: Reply from 61.135.253.16: bytes=10000 time=169ms TTL=55 Reply from 61.135.253.16: bytes=10000 time=171ms TTL=55 Reply from 61.135.253.16: bytes=10000 time=187ms TTL=55 Ping statistics for 61.135.253.16: Packets: Sent = 11, Received = 11, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 169ms, Maximum = 187ms, Average = 172ms Control-C ^C

ping www.163.com -i 3 Pinging www.cache.gslb.netease.com [61.135.253.16] with 32 bytes of data: Reply from 124.161.1.53: TTL expired in transit. Ping statistics for 61.135.253.16: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms

tracert www.163.com Tracing route to www.cache.gslb.netease.com [61.135.253.16] over a maximum of 30 hops: 1 48 ms 30 ms 46 ms 221.10.0.174 2 46 ms 30 ms 30 ms 124.161.1.157 3 30 ms 30 ms 30 ms 124.161.1.53 4 31 ms 30 ms 30 ms 124.161.1.77 5 77 ms 77 ms 77 ms 219.158.9.81 6 77 ms 77 ms 77 ms 202.96.12.38 7 77 ms 77 ms 77 ms 61.148.156.74 8 77 ms 77 ms 77 ms bt-229-122.bta.net.cn [202.106.229.122] 9 77 ms 77 ms 77 ms 61.49.41.138 10 77 ms 77 ms 77 ms 61.135.253.16 Trace complete.

TTL概述 TTL是IP协议包中的一个值，它告诉网络路由器包在网络中的时间是否太长而应被丢弃。有很多原因使包在一定时间内不能被传递到目的地。 例， 不正确的路由表可能导致包的无限循环。一个解决方法就是在一段时间后丢弃这个包，然后给发送者一个报文，由发送者决定是否要重发。TTL的初值通常是系统 缺省值，是包头中的8位的域。TTL的最初设想是确定一个时间范围，超过此时间就把包丢弃。由于每个路由器都至少要把TTL域减一，TTL通常表示包在被 丢弃前最多能经过的路由器个数。当记数到0时，路由器决定丢弃该包，并发送一个ICMP报文给最初的发送者。

TTL值 使用多路复用的IP协议，TTL值表示一个包被转发的范围有以下转换： 0， 限制在同一主机 1， 限制在同一子网 32， 限制在同一节点 64， 限制在同一区域（region）128， 限制在同一大陆（continent）255，

网状结构

TTL值的应用 通过TTL值不同返回的TTL值判断目标系统的类型 TTL的值是不一定的，是可以修改的。有些特殊的、系统（如NIDS）会定义特殊的TTL值，以拒绝非法访问数据进入。我们在执行PING命令时可 以用-i参数指定TTL值，大家可以将TTL设置为0，则该包将被立即丢弃。有时我们执行了一个PING 命令，在提示时却显示了另一个地址，并带有一个英语的提示（大致意思是TTL无效），则表示该包在到达目标之前（也就是到返回IP位置时），包所带的 TTL已经为0了或小于下一网段许可通过的TTL值了，该包已经被路由丢弃了.

主机的默认TTL值 LINUX Kernel 2.2.x & 2.4.x ICMP 回显应答的 TTL 字段值为 64 FreeBSD 4.1, 4.0, 3.4; Sun Solaris 2.5.1, 2.6, 2.7, 2.8; OpenBSD 2.6, 2.7, NetBSD HP UX 10.20 ICMP 回显应答的 TTL 字段值为 255 Windows 95/98/98SE Windows ME ICMP 回显应答的 TTL 字段值为 32 Windows NT Windows 2000 ICMP 回显应答的 TTL 字段值为 128

因为TTL值为55，根据默认的TTL值确定为该服务器LINUX 例一 Pinging www.baidu.com [202.108.22.5] with 32 bytes of data: Reply from 202.108.22.43: bytes=32 time=41ms TTL=55 Reply from 202.108.22.43: bytes=32 time=42ms TTL=55 Reply from 202.108.22.43: bytes=32 time=42ms TTL=55 Reply from 202.108.22.43: bytes=32 time=42ms TTL=55 Ping statistics for 202.108.22.43:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 41ms, Maximum = 42ms, Average = 41ms 因为TTL值为55，根据默认的TTL值确定为该服务器LINUX

例二 根据默认TTL值，可以确定该服务器为UNIX ping www.google.com Pinging www.l.google.com [64.233.189.99] with 32 bytes of data: Reply from 64.233.189.99: bytes=32 time=84ms TTL=244 Reply from 64.233.189.99: bytes=32 time=93ms TTL=244 Ping statistics for 64.233.189.99: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 84ms, Maximum = 93ms, Average = 90ms 根据默认TTL值，可以确定该服务器为UNIX

例三 tracert www.google.com Tracing route to www.l.google.com [64.233.189.104] over a maximum of 30 hops: 1 37 ms 45 ms 46 ms 221.10.0.174 2 30 ms 30 ms 30 ms 221.10.0.173 3 46 ms 46 ms 46 ms 124.161.1.53 4 46 ms 46 ms 46 ms 124.161.2.177 5 77 ms 77 ms 77 ms 219.158.12.213 6 77 ms 77 ms 77 ms 219.158.3.66 7 93 ms 77 ms 77 ms 219.158.3.130 8 155 ms 77 ms 77 ms 219.158.32.230 9 77 ms 93 ms 77 ms 64.233.175.207 10 77 ms 77 ms 77 ms 209.85.241.56 11 77 ms 77 ms 93 ms 66.249.94.34 12 77 ms 77 ms 77 ms hk-in-f104.google.com [64.233.189.104] Trace complete.

谢 谢 ！