Do Ping and TCP Really Follow the Same Route? Exploring ECMP and Routing Mechanics

1. Network Path

When you want to know whether your machine can reach a destination, you usually run the ping command. A successful ping shows 0 % packet loss, meaning the network is reachable; 100 % loss means the destination is unreachable. However, a reachable ping does not guarantee that a TCP connection will follow the same route.

Ping uses ICMP, while TCP uses the IP layer as well but with a different transport protocol. Both packets start at the same physical layer, but the network may route them differently.

2. How Paths Are Determined

Routers (or switches) forward packets based on routing tables. A routing table is built by protocols such as OSPF (Open Shortest Path First), which implements Dijkstra's algorithm to compute the shortest‑cost paths in the network graph. Each link in the graph has a cost or weight; the router selects the route with the lowest total cost.

If multiple routes match a destination, the router first prefers the longest prefix match (more specific route). If the prefix length is equal, it chooses the route with the lowest administrative distance (AD). If AD is also equal, the route with the smallest metric (cost) wins.

3. ECMP (Equal‑Cost Multi‑Path)

When several routes have identical cost, the router can enable ECMP, allowing traffic to be distributed across all equal‑cost paths. This doubles available bandwidth but introduces packet reordering because packets from the same TCP flow may travel different paths.

TCP guarantees in‑order delivery by assigning a sequence number to each segment. If packets arrive out of order, they are placed in a reordering queue, consuming receive‑buffer memory. Excessive reordering shrinks the receive window and reduces throughput.

4. TCP vs. Ping Path Differences

Routers often use a hash of the five‑tuple (source IP, source port, destination IP, destination port, protocol) to select an ECMP path. ICMP packets have no port numbers, so their five‑tuple differs from TCP packets, leading to different hash keys and potentially different routes.

Even for two TCP connections between the same hosts, the source port can change, producing different five‑tuples and thus different ECMP paths.

5. Practical Troubleshooting

If ping succeeds but a TCP connection sometimes fails, ECMP may be the cause. Use traceroute to see whether multiple hops show several IPs at the same hop, indicating ECMP.

Example of checking the TCP receive buffer:

# 查看接收缓冲区
$ sysctl net.ipv4.tcp_rmem
net.ipv4.tcp_rmem = 4096(min)    87380(default)  6291456(max)
# 缓冲区会在min和max之间动态调整

To reproduce the issue, force a specific source port with nc: nc -p 6666 baidu.com 80 If the connection always fails with one source port but succeeds with another, the problem is likely on the specific ECMP path.

6. Summary

Routers generate routing tables via OSPF, match destination IPs, and select the best path based on prefix length, administrative distance, and metric. When multiple equal‑cost routes exist, ECMP can be used to balance traffic, but it may cause packet reordering for TCP flows. Using five‑tuple hashing ensures that packets of the same connection follow the same path, mitigating reordering. Tools like traceroute, ping, and nc help diagnose ECMP‑related connectivity problems.