Hacker News Reader

Comment by palijer | Hacker News Reader

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

View on HN

But a great test for “am I getting out to the net” that’s ok to have a low specificity.

So it is not smart to make a lot of decisions based on “ping 1.1” timing out, it is so quick it’s a good first step in trying to debug a network issue.

>DNS servers should not be used as "internet connectivity tests" by pinging them.

Not true.

>They are not maintained as ICMP test servers, and that is not their purpose.

Irrelevant.

>While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

8.8.8.8 and 1.1.1.1 and all the major ones don't care.

Pinging DNS servers is highly productive and easy. There is nothing bad with using them as internet connectivity tests or SLA measurements.

So, what should we ping for testing Internet connectivity ?

There’s ping.sunet.se as maintained by the Swedish University Network (i.e. the network connecting Swedish Universities; there is no single “Swedish University”).

The advantage of pinging IPs is that you don’t have to have a working DNS setup to test your connection. If DNS does work, then your connection probably works, too.

In this case one should run "ping -n", otherwise ping will hang trying to resolve the IP into an hostname, if the DNS is misbehaving or not responding.

what default(included in OS) ping utility tries to reverse-lookup an address before pinging, and hangs if it can't.

I've never observed this in any version of Windows nor Linux.

You are better off using traceroute to one of these addresses, you should at least get some route outside of your own network.

Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).

On unixes, traceroute typically uses UDP by default (nowadays, ICMP is often an option, as are TCP SYN packets). Windows' tracert uses ICMP.

I believe this is because you need root privileges/special capabilities to send ICMP packets.

Yes. I wasn’t perfectly clear there. You’re correct for the initial src packet, the TTL exceeded response is ICMP, I think always.

The important difference is that you can trust no host on the internet to actually respond to pings, especially not machines prone to receive DOS attacks, like public DNS resolvers. Traceroute is for testing connectivity, ping is an archaic test to see if a machine is running.

I just ping google.com when I need a quick sanity check.

Which doesn't help if your DNS isn't working

I've used the thing [0] from grc.com, is there other ways that are reliable as well?

https://www.grc.com/dns/benchmark.htm

I use this as well. Found it very helpful.

I'm more often in need of CLI that does that for me and have grown used to:

https://github.com/cleanbrowsing/dnsperftest

Please, for the love of all that is holy, stop blocking ICMP! It's needed for things like Path MTU Discovery. With the increasing use of VPNs and tunnels (IPSec, Wireguard, GRE, etc) PMTUD is more important than ever.

At a minimum, any node on the internet routing or serving traffic needs to keep ICMP open. If you're running a DNS server, ICMP should be working.

https://groups.google.com/d/msg/public-dns-discuss/p1o62SJEl...

TL;DR: At the risk of repeating myself: Google Public DNS is a Domain Name System service, not an ICMP network testing service.

you can just set a lower TTL and get a response from a hop somewhere in your ISP's net.

are there known ICMP test servers ?

Reply on news.ycombinator.com