Why woud ping fail but not traceroute

Question

For a few days now I started making the interesting observation of a machine intermittently not responding to an ICMP ping, while it still responds to an ICMP based traceroute (specifically set via the -I parameter).

As far as I know both would use ICMP's echo request, so I wouldnt expect any difference there.

Would anyone have an explanation for this?

Solution

Most probably the pong from ping is blocked/gets discarded, while traceroute uses an error message form a node/hop to determine the route. Traceroute is not a standard tool, in that it uses a trick to get the information. The trick is to manipulate the TTL, so the hop responds with an ICMP error (ICMP TTL exceeded), and that is why this is possible.

Comments

[ErikE]

ICMP ping primarily uses icmp echo request and icmp echo reply. traceroute/tracert on the other hand depend a bit on the implementation. I suggest: en.m.wikipedia.org/wiki/Traceroute or the awesome amazon.com/…

[Admin]

Thanks Konrad, if I understand you correctly you are saying it would work because instead of sending an ICMP reply it sends a TTL exceeded and the former would be blocked, while the latter wouldnt be. Correct?

[Konrad Gajewski]

Yes. Why it blocks the pong - I don't know. I can just guess. From my experience, I have rarely seen traceroute blocked, but ICMP echo gets blocked more often. But since you are saying that it is intermittent, something else must be going on. You need to diagnose it further. Faulty firewall? Failing equipment?