1. The Story
Press "Next" to go through it step by step. In each step a character appears and explains what they are doing.
Prologue: A Quick Recap
Step 1 of 12
Pip's Journey
To get from Mac to example.com, I have to pass Rue at home, the ISP Router and a Router out on the Internet. Every time I pass a Router, the TTL (Time to Live) on my backpack goes down by 1. When it hits 0, I get thrown away.
Animation text version (all steps)
- Prologue: A Quick Recap
- Pip's Journey · Pip: To get from Mac to
example.com, I have to pass Rue at home, the ISP Router and a Router out on the Internet. Every time I pass a Router, the TTL (Time to Live) on my backpack goes down by 1. When it hits 0, I get thrown away.- Details: Story 9, "Out the Front Door"
- Act 1: The Network Doctor's Stethoscope
- The Page Won't Open! · Mac: I can't open
example.com! Is my Wi-Fi broken? Is Rue sick? Is the ISP having trouble? Or is the server switched off? I have no idea where to start. - ICMP: The Network's Report Letters · Rue: Don't panic, the network doctor is on call! Routers and computers have a special kind of message just for reporting and testing, called ICMP (Internet Control Message Protocol). First tool: Ping.
- Echo Request: "Are you there?"
- Echo Reply: "I'm here!"
- Time Exceeded: "TTL reached 0, packet thrown away"
- Destination Unreachable: "You can't get there from here"
- First, Check Rue's Heartbeat · Pip: Mac types
ping 192.168.1.1. I carry an Echo Request to Rue: "Are you there?" Rue answers straight away with an Echo Reply: "I'm here!" The round trip takes just 1 millisecond.time=1.2 ms→ the home network is fine
- Next, the Server's Heartbeat · Pip: Next comes
ping 192.0.2.80. This time I go much further, but the server replies too! The round trip is about 12 milliseconds. The network is open from end to end.time=12.3 ms: the Round-trip Timettl=61: the TTL left when the reply arrives
- Diagnosis Found · Rue: The IP Address can be reached, but
ping example.comsays it can't find the name. The cause is DNS (Domain Name System)! Mac fixes the DNS setting, and the page opens.- ① Ping the home Router: checks the home network
- ② Ping an IP Address on the Internet: checks the whole route
- ③ Ping the website name: checks DNS
- Act 2: Traceroute Calls the Roll
- Which Stop Is Slowest? · Mac: The page opens now, but it's really slow. Ping only tells me "the round trip is about 180 milliseconds". It doesn't tell me which stop is holding things up. Is there a way to check each stop in turn?
- TTL = 1 · Pip: Traceroute to the rescue! It deliberately sets my TTL to 1. As soon as I reach Rue at home, the TTL drops to 0 and I'm thrown away. Rue replies with ICMP Time Exceeded: "I'm stop 1,
192.168.1.1." - TTL = 2 · Pip: This time the TTL is set to 2. After Rue it's down to 1, and at the ISP Router it hits 0. The ISP Router replies: "I'm stop 2,
203.0.113.254." - TTL = 3, 4... · Pip: With TTL = 3, the Internet Router
192.0.2.1reports that it's stop 3. With TTL = 4, I finally reach the server, and it replies "Arrived!" The whole route has been listed.1 192.168.1.1 1.2 ms2 203.0.113.254 6.8 ms3 192.0.2.1 180.5 ms← slows down from this stop4 192.0.2.80 182.1 ms
- Silence Doesn't Mean Sickness · Rue: Sometimes a stop shows
* * *, or Ping keeps timing out. That device or Firewall may simply be set not to reply to ICMP, and it's actually working fine. A good doctor combines several check results before making a diagnosis! - Summary: The Network Doctor's Toolkit · Rue: Ping tests "Are you there?" and the round-trip time. Traceroute uses TTL to check each stop in turn and find which stretch has the problem. Both rely on ICMP report letters. Next time you can't get online, you can be the network doctor too!
2. Where Is the Problem
To get from Mac (192.168.1.10) to example.com (192.0.2.80), Pip has to pass through several stops: Rue at home, the Router of the ISP (Internet Service Provider), a Router out on the Internet, and finally the server. A Router is a device that decides which way each packet should travel next. (Note: an address starting with 192 is not always Private. Only addresses starting with 192.168 are.)
When a web page won't open, the browser only shows one line: "Can't connect". But many things could have gone wrong:
- Has Mac's own Wi-Fi (wireless network) dropped?
- Has Rue at home crashed?
- Is there a problem with the ISP's line?
- Is the server switched off?
- Or can DNS (Domain Name System) not find the name?
If you don't know the cause, all you can do is try things at random: restart, unplug cables, phone in a complaint... It takes ages, and it may not even help.
3. How the Network Solves It
A doctor starts by listening to your heartbeat with a stethoscope, then checks each part of your body one by one.
The network has its own "stethoscope": ICMP (Internet Control Message Protocol). It is a set of messages that Routers and computers use especially for reporting errors and running tests.
Two everyday tools work by using ICMP replies:
- Ping: asks the other side "Are you there?" and measures how long the round trip takes.
- Traceroute: uses TTL (Time to Live) to call the roll stop by stop, listing every Router that Pip passes along the way.
4. A Closer Look
Common ICMP messages
ICMP messages travel inside IP packets. Each kind of message is identified by a Type number:
| Type | Name | Meaning |
|---|---|---|
| 8 | Echo Request | "Are you there?" |
| 0 | Echo Reply | "I'm here!" |
| 11 | Time Exceeded | "TTL reached 0, so the packet was thrown away." |
| 3 | Destination Unreachable | "You can't get there from here." |
Ping: listening for a heartbeat
Ping sends an Echo Request, and the other side answers with an Echo Reply. Here is an example from macOS/Linux (the Windows format looks a little different, but the content is the same):
$ ping 192.0.2.80
64 bytes from 192.0.2.80: icmp_seq=0 ttl=61 time=12.3 ms
64 bytes from 192.0.2.80: icmp_seq=1 ttl=61 time=12.1 ms
64 bytes from 192.0.2.80: icmp_seq=2 ttl=61 time=12.6 ms
time=12.3 ms: the Round-trip Time, which is the time from sending the request to receiving the reply.ttl=61: the TTL still left on the backpack when the reply reaches Mac. Many systems start at 64, so this reply passed through 3 Routers. Traceroute below will list those same 3 stops.- When there is no reply, Windows shows
Request timed out, macOS showsRequest timeout for icmp_seq …, and Linux simply prints no new line at all.
The three-step check-up
In the story, Mac runs Ping three times, in order:
| Step | Command | Result | What it tells us |
|---|---|---|---|
| ① | ping 192.168.1.1 |
Success, about 1 ms | The home network is fine |
| ② | ping 192.0.2.80 |
Success, about 12 ms | The whole route is open |
| ③ | ping example.com |
Can't find this name | The cause is DNS |
Working from near to far, each step rules out one possibility. If you can reach something by its IP Address (its network address) but not by its name, the problem is most likely DNS.
Traceroute: calling the roll stop by stop
Every time an IP packet passes through a Router, its TTL goes down by 1. When it reaches 0, that Router throws the packet away and replies with ICMP Time Exceeded. Traceroute uses exactly this:
- Send a packet with TTL = 1 → stop 1 (Rue at home) replies with Time Exceeded.
- Send a packet with TTL = 2 → stop 2 (the ISP Router) replies with Time Exceeded.
- And so on, until the packet reaches the destination, which replies "Arrived".
The sender of each reply is the IP Address of that stop. Each stop along the way is called a Hop. In practice, each stop is usually tested 3 times, so every line shows 3 times.
Later the web page did open, but it was very slow. Mac ran Traceroute again:
$ traceroute 192.0.2.80
1 192.168.1.1 1.2 ms 1.1 ms 1.3 ms
2 203.0.113.254 6.8 ms 7.0 ms 6.9 ms
3 192.0.2.1 180.5 ms 181.2 ms 179.8 ms
4 192.0.2.80 182.1 ms 182.6 ms 181.9 ms
The time jumps at stop 3 and stays high after that. This means the stretch between stop 2 and stop 3 has become slow.
Different computers, different commands
- Windows: type
tracert. It explores the route with ICMP Echo Requests. When it reaches the destination, the destination answers with an Echo Reply. - macOS/Linux: type
traceroute. By default it explores the route with UDP (User Datagram Protocol) packets. When it reaches the destination, the destination answers with Destination Unreachable, meaning "no program is using this Port". (A Port is a numbered door that tells a computer which program should receive the data.) That is how Traceroute knows it has reached the end.
* * *: silence doesn't mean sickness
If a stop shows * * *, it means that stop didn't reply to any of the 3 tries. Possible reasons:
- That Router or Firewall (a guard that decides which traffic may pass) is set not to reply to ICMP;
- The Router is too busy and puts replying to ICMP at the bottom of its to-do list.
If the stops after it still reply, that stop is actually working fine. Only when "everything from a certain stop onwards is * * *" does it look more like the connection is really broken.
5. Try It Yourself
Mission: be a network doctor
- Open "Command Prompt" (Windows) or "Terminal" (macOS).
- Type
pingfollowed by the address of your home Router (often192.168.1.1or192.168.0.1). Windows sends 4 times by default and then stops; macOS keeps going until you press Ctrl + C. - Next, Ping the name of a website you often visit, and compare the
timevalues of the two. - Finally, type
tracert website-name(Windows) ortraceroute website-name(macOS) and count how many stops there are between your home and that website. Do you see any* * *?
Mini game
Traceroute in the right order
Mac runs traceroute. Put the five steps that find the first and second stops in the right order.
- Mac notes that stop 1 is 192.168.1.1
- Send a packet with TTL = 1
- The ISP Router brings the TTL down to 0 and replies with Time Exceeded
- Rue at home brings the TTL down to 0, throws the packet away and replies with Time Exceeded
- Send a packet with TTL = 2
6. Where the Analogy Breaks
- No reply to Ping doesn't mean the other side is "dead". Many servers and Firewalls deliberately don't answer Ping, yet their web pages open just fine. If the doctor can't hear a heartbeat, the patient might just be wearing a thick coat.
- A successful Ping doesn't guarantee the web page will open. Ping only proves the other side received ICMP. Web pages use TCP (Transmission Control Protocol) Port 443, and that service might have stopped.
- Traceroute only shows "one direction". The way there and the way back may take different routes. Each probe packet may also take a different route, so sometimes one stop shows two different addresses.
- A slow stop in the middle isn't always to blame. Routers usually give replying to ICMP the lowest priority. So if one stop alone looks slow while the stops after it are normal, it is usually just being lazy about replying, not a real traffic jam.
- The network doctor only examines; it doesn't cure. Ping and Traceroute only tell you which stretch has the problem. To fix it, you still need whoever is in charge of that stretch, such as yourself, your ISP or the website's administrator.
7. Quiz
8. Key Notes
- ICMP (Internet Control Message Protocol) is the network's "report letter", used for reporting errors and running tests.
- Ping sends an Echo Request (Type 8), the other side replies with an Echo Reply (Type 0), and Ping measures the Round-trip Time.
- Ping from near to far: home Router → an IP Address on the Internet → a website name. This lets you track down the cause step by step.
- Traceroute starts at TTL = 1 and adds 1 each time. Each stop replies with Time Exceeded (Type 11) when the TTL reaches 0, which lists the whole route. Windows uses
tracert; macOS/Linux usetraceroute. * * *or a failed Ping may simply mean the other side doesn't reply to ICMP. Combine several checks before you make a diagnosis.
Further reading
With Ping and Traceroute, you can already give your own network a check-up. But Pip passes through so many stops along the way. Could someone peek at the letter in his backpack, or even change it? In the next story, we'll see how HTTPS and TLS (Transport Layer Security) seal the envelope and stamp it with a wax seal.