Lab 09-02 · Ping and Netwatch¶

You send a message on WhatsApp and wait. One grey tick: it left your phone. Two grey ticks: it reached your friend's phone. That little wait tells you two things: is the other side alive? and how far away is it?

Routers ask the same two questions all day long, with a tool called ping. And with Netwatch, a router can keep asking by itself, every few seconds, and do something the moment the answer changes: write a warning, send an e-mail, switch to a backup line.

Ping: "are you there?"¶

Ping sends an ICMP echo request to a host and waits for the echo reply. The time between the two is the round-trip time (RTT).

ICMP (Internet Control Message Protocol) is the network's own message service: small packets for "are you there?", "I'm here", "I can't reach that network". Ping uses two of them.

The analogy for this lab is a lighthouse keeper with a lamp. Ping is flashing the lamp at a ship and waiting for the ship to flash back. If it flashes back, the ship is there. How long it takes tells you how far it is.

flowchart LR
    R1["<b>r1</b><br>the lighthouse"]
    H["<b>host</b><br>the ship"]
    R1 -->|"echo request (flash)"| H
    H -->|"echo reply (flash back)"| R1

Netwatch: the keeper who never sleeps¶

Netwatch (Tools → Netwatch) probes a host again and again. When the result changes it sets the status to up or down and runs the matching script: up-script or down-script.

The keeper does not flash once; he flashes every 5 seconds, all night, and rings a bell when a ship disappears. RouterOS v7 gives him several kinds of lamp, the probe type:

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10<br>web server :80<br>40 ms away"]
    CAP["<b>class-ap</b><br>10.0.0.1 · 198.51.100.1<br>DNS: www.mikrotik.com"]
    subgraph R1["r1 · your router"]
        WAN["ether2 (WAN)<br>10.0.0.x by DHCP"]
        BR["<b>bridge1</b><br>192.168.88.1/24"]
    end
    PC1["<b>pc1</b><br>your laptop<br>DHCP 192.168.88.x"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    WAN --- BR
    BR ---|"ether3"| PC1

Start the lab¶

Download the lab files and unzip them: 09-02-ping-netwatch.zip. Open a terminal inside the 09-02-ping-netwatch folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then open the router and the laptop:

ssh admin@clab-mtcna-09-02-r1                 # password: admin
docker exec -it clab-mtcna-09-02-pc1 bash

At any moment, CLAB_EXEC="docker exec" ./check.sh tells you what is already solved.

Step 1 · Ping your laptop from the router¶

First you need the laptop's address. r1 gave it by DHCP, so r1 knows it.

WinBox: IP → DHCP Server → Leases. Then Tools → Ping, Ping To: the lease address, Start.

/ip dhcp-server lease print
/ping 192.168.88.200 count=5

Use the address from your own lease list (in our test it was 192.168.88.200). Expected:

  SEQ HOST              SIZE TTL TIME
    0 192.168.88.200      56  64 184us
  ...
    sent=5 received=5 packet-loss=0% min-rtt=159us avg-rtt=193us max-rtt=238us

us means microseconds (millionths of a second). The laptop is one cable away.

Done when you have five replies from your laptop.

Step 2 · Ping www.mikrotik.com and compare¶

The course says: open a New Window in WinBox and ping www.mikrotik.com while the first ping runs. In the CLI, just run it:

/ping www.mikrotik.com count=5

Expected: replies from 198.51.100.10 with TIME around 40ms, and a lower TTL (63).

Done when you can explain why the two RTTs are so different.

Step 3 · Watch the Internet server with an icmp probe¶

Now the keeper starts his night shift. He will flash at the Internet server every 5 seconds and write to the log when it disappears or comes back.

WinBox: Tools → Netwatch → +. Name internet-ping, Type icmp, Host 198.51.100.10, Interval 5s, Startup Delay 0s. In the Up tab: :log warning "netwatch: Internet UP". In the Down tab: :log error "netwatch: Internet DOWN".

/tool netwatch add name=internet-ping type=icmp host=198.51.100.10 interval=5s startup-delay=0s comment="Can we reach the Internet server?" up-script=":log warning \"netwatch: Internet UP\"" down-script=":log error \"netwatch: Internet DOWN\""
/tool netwatch print

Inside the scripts, the inner quotes are written \" so they do not close the outer ones.

Expected a few seconds later: status up, and in the log script,warning netwatch: Internet UP.

/log print where message~"netwatch:"

Done when /tool netwatch print shows the icmp probe up.

Step 4 · Watch the web service with a tcp-conn probe¶

Ping only says the machine is on. A shop's web server can be on and still not sell anything. A tcp-conn probe opens a TCP connection to port 80, which only succeeds if the web server program is running.

WinBox: Tools → Netwatch → +. Name web, Type tcp-conn, Host 198.51.100.10, Port 80, Interval 5s, Startup Delay 0s, scripts as below.

/tool netwatch add name=web type=tcp-conn host=198.51.100.10 port=80 interval=5s startup-delay=0s comment="Is the web server answering?" up-script=":log warning \"netwatch: WEB UP\"" down-script=":log error \"netwatch: WEB DOWN\""
/tool netwatch print

Expected: two probes, both up.

Done when both probes are up.

Step 5 · Break the web server and watch the keeper react¶

Now the real test: stop the web program on the Internet server, but leave the machine running. Open a third terminal on your Ubuntu PC:

docker exec clab-mtcna-09-02-internet pkill -f http.server

Wait 10–15 seconds and look on r1:

/tool netwatch print
/log print where message~"netwatch:"

Expected: web is down, internet-ping is still up, and the log has script,error netwatch: WEB DOWN.

Start the web server again:

docker exec clab-mtcna-09-02-internet sh -c 'cd /srv/www && nohup python3 -m http.server 80 >/dev/null 2>&1 &'

A few seconds later the log shows netwatch: WEB UP.

Done when you have seen WEB DOWN and WEB UP while the icmp probe stayed up. Run CLAB_EXEC="docker exec" ./check.sh: it repeats this test by itself and must end with RESULT: lab solved.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• Ping sends an ICMP echo request and measures the round-trip time (RTT).
• A LAN host answers in microseconds; an Internet host in milliseconds: distance and routers add up.
• Netwatch probes hosts on an interval and runs an up-script or down-script when the status changes.
• Type icmp says the machine is alive; tcp-conn says the service on that port works.
• Netwatch waits a startup-delay (5 minutes by default) before it starts probing.

Quick check¶

Next: when a ping fails, where along the way did it fail? That is the job of traceroute and the rest of the toolbox.