Why Does Ping Fail? From Theory to Real‑World Network Troubleshooting

Fundamental Concepts Learned in College

Many developers have a vague understanding of network basics, which prevents them from turning knowledge into practical problem‑solving skills.

The RFC1180 diagram illustrates these concepts, but without hands‑on practice they are quickly forgotten.

Starting from a Real Problem

We encountered a ping failure in a container‑to‑physical‑machine scenario:

Container 1 cannot ping Physical 2.

Container 2 on Physical 1 can ping Physical 2.

Latency varies dramatically between containers on the same host.

All containers can ping external IPs (e.g., Baidu).

The issue persisted for a week because the container network was self‑configured while the switch was managed by the customer.

Consider this interview question: after typing ping IP and pressing Enter, what actually happens?

Review of College Knowledge

Route Table

When pinging 172.17.0.2, the route table shows which interface (e.g., docker0) the packet will use. Pinging an external IP like 1.1.4.4 would use eth0 after subnet checking.

ifconfig

Examining the host’s network interfaces reveals three NICs, each with its own IP and netmask. The appropriate NIC is chosen based on the destination IP and the route table.

ARP Protocol

ARP resolves an IP address to a MAC address. Each OS caches ARP entries (typically 15 minutes) and can manually clear them. The ARP cache screenshot shows current mappings.

What Happens After Pressing Enter?

The OS builds an ICMP packet, fills the header with source IP/MAC, and selects the outgoing interface according to the routing table.

If Destination Is in the Same Subnet

The host checks its ARP cache; if the MAC is missing, it broadcasts an ARP request. The target replies with its MAC, which is cached for subsequent packets. The ICMP echo request is then sent directly to the target’s MAC.

<img src="https://mmbiz.qpic.cn/mmbiz_png/LwZPmXjm4Wwu8Zib2dKqye472EUQghEKQnSMEQPhgtPw0T4cqczCUguJTCiborTF9ibjEGAvyhZHjyXQFXWHge8eA/640?wx_fmt=png"/>

If Destination Is in a Different Subnet

The packet is sent to the gateway’s MAC (found via ARP). The gateway forwards the packet toward the destination, possibly through multiple hops, each changing the destination MAC while keeping the IP unchanged.

<img src="https://mmbiz.qpic.cn/mmbiz_png/LwZPmXjm4Wwu8Zib2dKqye472EUQghEKQW0U2CgcBTfsic362EhTQrbeG6iayqXIHzs85Via3avhgJBHVjydzqWuSQ/640?wx_fmt=png"/>

ARP Broadcast Storms and Spoofing

Large subnets can suffer broadcast storms due to excessive ARP requests. ARP spoofing occurs when a malicious host answers ARP queries with false MAC addresses, diverting traffic.

Answering the Opening Problem

After reviewing the fundamentals, we can explain why the ping failed. The root cause was the switch’s HSRP (Hot Standby Router Protocol) configuration, which misrouted return packets, causing high latency and loss. Disabling HSRP restored connectivity for all containers.

Is Network Connectivity a Complex Issue?

Often, services appear unreachable because of network problems, but the real issue may be a dead or hung application. Properly segmenting the path (src → src‑gateway → dest‑gateway → dest) and using tools like tcpdump helps pinpoint failures.

Practical Tips for Developers

Verify service ports with telnet or similar tools.

Check process health; a dead process won’t listen on its port.

Monitor TCP connection queues; a full queue can reject new connections.

When network metrics look normal but applications time out, the problem is often in the application layer, not the network.

Summary

Network packet loss, latency, and jitter are easy to blame on the network, but accurate diagnosis requires solid fundamentals, logical reasoning, and evidence from packet captures. Mastery of routing, ARP, and interface configuration turns theoretical knowledge into practical troubleshooting power.

Open Questions

How does a server determine the source IP and destination MAC for reply packets?

Do TCP and UDP differ in how they set these fields?

Given that LAN communication relies on MAC addresses, what role does the IP address play?