ping message table...

from cisco's site...

http://www.cisco.com/en/US/docs/ios/12_3/configfun/command/reference/cfr_1g06.html#wp1075989

Character	Description
!	Each exclamation point indicates receipt of a reply.
.	Each period indicates that the network server timed out while waiting for a reply.
U	A destination unreachable error protocol data unit (PDU) was received.
C	A congestion experienced packet was received.
I	User interrupted test.
M	Could not fragment.
?	Unknown packet type.
&	Packet lifetime exceeded.

more arp...

when you ping a device for the first time (as in below) the hardware address becomes associated with the ip address and is placed in the pc's arp table, it does not get associated with the gateway router's interface mac address...

C:\>arp -a

Interface: 192.168.1.9 --- 0x2
  Internet Address      Physical Address      Type
  192.168.1.1           c0-3f-0e-ab-d1-ec     dynamic
  192.168.1.250         98-4b-e1-fb-29-40     dynamic

below is the mac-address-table entry for fa0/17, the port that this device is attached to... the arp table in the pc DOES NOT represent the hardware address of the gateway router...

sw2950_02#sh mac-add int fa0/17
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    984b.e1fb.2940    DYNAMIC     Fa0/17
Total Mac Addresses for this criterion: 1
sw2950_02#

the mac address for this arp is the mac address of the device that was pinged.

router on a tip...

it doesn't get easier than this...

get a router a switch and 2 pc's...
connect a straight through cable from the router to a port on a switch... remove the ip address from the fa0/0 first and always, when making subinterfaces (frame and ppp too)... make two subinterfaces on the router
encap dot1q 21 means what it says; encapsulation dot1q for vlan 21...
give each sub ip's on different subnets (intervlan routing; now i got a network boner)


r2620_02#config t
Enter configuration commands, one per line.  End with CNTL/Z.
r2620_02(config)#int fa0/0.21
r2620_02(config-subif)#encap dot1q 21
r2620_02(config-subif)#ip add 192.168.21.1 255.255.255.0
r2620_02(config-subif)#no shut
r2620_02(config-subif)#int fa0/0.22
r2620_02(config-subif)#encap dot1q 22
r2620_02(config-subif)#ip add 192.168.22.1 255.255.255.0
r2620_02(config-subif)#no shut
r2620_02(config-subif)#

swich time..
make two vlans, make a trunk (assigning vlans to the trunk is optional, why, because they forward all vlan traffic by default unless otherwise slapped around), put an interface into each vlan and you got...

s2(config)#vlan 21
s2(config-vlan)#name 21
s2(config-vlan)#vlan 22
s2(config-vlan)#name 22
s2(config-vlan)#exit
s2(config)#int fa0/17
s2(config-if)#sw mode trunk
s2(config-if)#sw trunk allow vlan 21,22
s2(config-if)#exit
s2(config)#int fa0/15
s2(config-if)#sw mode acc
s2(config-if)#sw acc vlan 21
s2(config-if)#int fa0/16
s2(config-if)#sw mode acc
s2(config-if)#sw acc vlan 22
s2(config-if)#do sh vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/5
10   fac/staff                        active    Fa0/11, Fa0/12, Fa0/13, Fa0/14
20   students                         active    Fa0/18, Fa0/19, Fa0/20, Fa0/21
                                                Fa0/22, Fa0/23, Fa0/24
21   21                               active    Fa0/15
22   22                               active    Fa0/16

connect a pc to each switch port and set ip's and gateways...

and then ping the damn things... don't forget to debug ip icmp on the router, see after pc pings...

C:\Users\bosgood>ping 192.168.21.1

Pinging 192.168.21.1 with 32 bytes of data:
Reply from 192.168.21.1: bytes=32 time=2ms TTL=255
Reply from 192.168.21.1: bytes=32 time=1ms TTL=255
Reply from 192.168.21.1: bytes=32 time=1ms TTL=255
Reply from 192.168.21.1: bytes=32 time=2ms TTL=255

Ping statistics for 192.168.21.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms


C:\Users\bosgood>ping 192.168.22.1

Pinging 192.168.22.1 with 32 bytes of data:
Reply from 192.168.22.1: bytes=32 time=2ms TTL=255
Reply from 192.168.22.1: bytes=32 time=2ms TTL=255
Reply from 192.168.22.1: bytes=32 time=1ms TTL=255
Reply from 192.168.22.1: bytes=32 time=1ms TTL=255

Ping statistics for 192.168.22.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 2ms, Average = 1ms

r2620_02#debug ip icmp
ICMP packet debugging is on
r2620_02#
Dec 22 18:47:13.575: ICMP: echo reply sent, src 192.168.21.1, dst 192.168.21.2
r2620_02#
Dec 22 18:47:14.575: ICMP: echo reply sent, src 192.168.21.1, dst 192.168.21.2
r2620_02#
Dec 22 18:47:15.579: ICMP: echo reply sent, src 192.168.21.1, dst 192.168.21.2
r2620_02#
Dec 22 18:47:16.583: ICMP: echo reply sent, src 192.168.21.1, dst 192.168.21.2

r2620_02#
Dec 22 18:49:39.983: ICMP: echo reply sent, src 192.168.22.1, dst 192.168.22.2
r2620_02#
Dec 22 18:49:40.987: ICMP: echo reply sent, src 192.168.22.1, dst 192.168.22.2
r2620_02#
Dec 22 18:49:41.987: ICMP: echo reply sent, src 192.168.22.1, dst 192.168.22.2
r2620_02#
Dec 22 18:49:42.991: ICMP: echo reply sent, src 192.168.22.1, dst 192.168.22.2
r2620_02#

that's a router on my...

achille's lists...

i hate ACL's, firewalls, filters and especially window's stupid firewall...  as a network guy i figure it to be my sworn duty to allow access to the wire, to give john Q user  the unmitigated freedom of  byte exploration... a perfect world... of course it becomes evident that john Q user will eventually get himself or the network in some kind of trouble with this very freedom...  so we first open the door, then slam it shut...

the standard ACL is concerned with the source... not a lot of flexibility there...  however, standard acl's shine  when used with NAT for a quick, painless solution to get the private network users released into the wild...

extended and named acl's are another universe, providing more elegant examples of slamming the door on john Q user...

stepping back...  why are standard acl's best utilized nearest the destination, and extended acl's best utilized nearest the source, besides the fact that cisco and odom and lammle, et al, have been pounding this into our collective minds for years? processing and WAN overhead, that's why... stopping hitler at Munich, like Clemenza said...  filter that shit where it lives (extended) and block that shit before it gets in (standard)

filtering telnet is easy; just turn it off and use SSH and/or VPN instead...

disallowing ICMP onto your private network is another matter...

r2620_01(config)#ip access-list extended no_outside_pings
r2620_01(config-ext-nacl)#deny icmp any any echo log
r2620_01(config-ext-nacl)#permit ip any any
r2620_01(config-ext-nacl)#exit
r2620_01(config)#int s0/1
r2620_01(config-if)#ip access-group no_outside_pings in
r2620_01(config-if)#

then:

r2620_03#ping 10.0.30.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.30.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
r2620_03#

stardate log 2620_01:

r2620_01#
Dec 10 08:13:56.815: %SEC-6-IPACCESSLOGDP: list no_outside_pings denied icmp 10.
0.30.2 -> 10.0.30.1 (8/0), 5 packets
r2620_01#

but do yourself a favor... keep ping  alive on the LAN

ICMP is your lover...

ICMP

Part of the network layer; instrumental in controlling and managing, troubleshooting.  There is no transport header, the ICMP message resides inside an IP packet.  Rfc 792

Echo request/reply

Sent and received by ping.  Pinging means sending an echo request.  Any data sent in echo request is returned in echo reply.  See extended ping.

Destination unreachable

1) network unreachable-no match in routing table at destination- sent by router

2) host unreachable- routes to destination network but no host response- sent by router

3)  can’t fragment- don’t fragment bit is set and a router must fragment in order to forward the packet (packet too large)- sent by router

4) protocol unreachable(unlikely, TCP or UDP)- delivered to host but layer 4 (transport) protocol is not available- sent by host

5) port unreachable- delivered to host, but destination port is not open- sent by host

ping codes: ! = echo received

                   . = nothing received before ping time out

                 U = unknown host

                 N = unknown network

                 P = unreachable port

                Q = source quench

                M = can’t fragment code

                 ? = packet unknown

Time exceeded

TTL (time to live) field in IP header has expired, therefore discarded (decremented by a router before forwarding; at zero, see ya) TRACE uses time exceeded

Redirect 

Used to tell the host there is a better local router to ship the packet to

ospf is all up in here...

r2620_01#sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

1.0.0.0/24 is subnetted, 1 subnets
C 1.1.1.0 is directly connected, Loopback0
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/65] via 10.0.0.2, 00:05:52, Serial0/1
100.0.0.0/32 is subnetted, 1 subnets
O 100.0.0.1 [110/2] via 192.168.1.100, 00:02:26, FastEthernet0/0
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/65] via 11.0.0.3, 00:05:52, Serial0/0
10.0.0.0/30 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, Serial0/1
11.0.0.0/24 is subnetted, 1 subnets
C 11.0.0.0 is directly connected, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet0/0
r2620_01#

my soho is now an ospf network...

how?
went to router 3 and added ospf (router ospf 3, the 2 networks)
same to router 2 and added the 2 directly connected networks,
then router 1 and it's 4 directly connected networks,
then went back and whacked eigrp on each router,
hopped over to the 3550, added ospf and it's directly conected networks, whacked eigrp, and
now everybody is pinging everybody...

took about 5 minutes...

a new beginning...

my first shipment arrived today, the 3550, i expect the rest of the gear tomorrow... it's kind of weird having the shit in my apartment... it'll be a constant reminder; configure me, connect me, make me go to porn sites... i'll do pictures tomorrow once i have them racked...

so i take the switch out of the box, set it on a stand for now, grab the console cable and i'm ready to connect it to my laptop...  no serial port... not a problem... i break out the old desktop, monitor, etc, power it up and i'm all set...  no serial port on that either and that's got to be five years old by now... damn... off to office max, nice that it's just up the road, and i look around a bit... over ten bucks for a power cable, nearly thirty for a long rj-45... i turn a corner and there is the section i'm looking for...  37 dollars for a serial to usb adapter... i have these visions that i'm about to nickel and dime myself into the poor house with this project... all right, buy it, return it before 14 days are up, and get a cheaper one on line... not a chance, 30 bucks on line not including shipping... good God...

had to install software for it also...  connect it up, run putty, select serial, com1, defaults to 8, none, and 1
and i get errors; serial port not found...  go to control-panel, system, hardware, (xp machine) and there it is... on com3...

works great... connected it up through the wireless router to the cable modem and i'm pinging the time warner gateway within moments... routers and more switches tomorrow...

the internet is slow today...

my 3614 was purring along smoothly, i was tasked with making it work nice with our nortel contivity firewall, and a web filter called bess...  bess was a dog, a real dog for the filter company owner...  bess was loyal, faithful and true and she didn't allow our users to go to unsavory sites any longer... of course her filtering caused processing overhead... and the contivity (a great firewall, but i didn't like the fruit inspired filtering icons) also took its toll on performance... toss in dns, dhcp and possibly a packet filter...  "geez the internet seems slow today"...  "seems fine to me"...  "it was faster yesterday"... the empirical evidence was overwhelming and always based on feelings... "it just feels slow is all"... "can you ping?"...  "yes, but what is that REALLY telling me?"... in a word, EVERYTHING...

packet internet groper has a way of restoring your sanity by way of proving network connectivty... but feelings are more reliable as far as management is concerned...  "the internet just doesn't seem right to day"...  here's a picture; try squeezing a ton of users through a garden hose at the same time... what do you get? an embittered user community and a busy help desk phone...  there was this thing once called a cache engine... stick it in the router and it will save url's for visited websites on our side of the fire wall and distribute them from inside the network...  nice idea...  didn't work very well..

what does work?  more frigging bandwidth... you've got 100 M behind the firewall  for hosts, now let's shove them through a five meg pipe to the isp...

how do you feel about your network today?