ping, ip, and ss

02Three questions, three commands

For an address question, ip address show displays IPv4 and IPv6 addresses assigned to local interfaces. It describes local configuration; it does not by itself establish that a remote application is responding.

For a local socket question, ss inspects socket information. The combined option -ltn contains -l for listening, -t for TCP and -n for numeric addresses and ports. It does not send a remote probe. A listener entry therefore supplies a different kind of evidence from a packet reply.

For an echo question, ping sends Internet Control Message Protocol, ICMP, echo requests and reports replies if received. ICMP is used for network control and diagnostic messages; it is separate from a TCP application connection. -c 2 stops after two requests. The address 127.0.0.1 is loopback and stays on the same host.

A missing echo reply can have several explanations. Filtering can block the request or reply, and a missing route can prevent the intended exchange. Those fit the fictional card without proving either cause. A reply also would not prove that a web application is available or that its content is correct.

The optional command forms are for later owned-environment use. You need no -K socket-closing option, flood option, scan or shared-interface capture for this lesson. The cards supply every required fact. If a later permitted command is refused, preserve the message and use the printed route rather than changing privileges.

03Read the fictional listener and the failed echo

The listener card shows one local endpoint and is explicitly not literal ss output. Read its state and port before comparing with the activity check. Keep that endpoint separate from the diagnostic command that could inspect it.

The echo card describes no reply to a fictional probe. Do not send that probe. Write the observation first, then two possible causes and the missing evidence that would distinguish them. This reuses the note-taking skill of separating a result from an explanation.

Choose a diagnostic by its question

An interface joins a host to a network. A route describes where traffic
goes toward a destination. A socket is a communication endpoint; a
listener waits for incoming traffic. ICMP, Internet Control Message
Protocol, carries control and diagnostic messages such as echo requests.

The commands below name jobs, not observed output from your machine.
For each card, separate the observation from any possible explanation.
A missing echo fits several causes; a listener is not a page response.
Use the printed records without sending any probe.

Command jobs for this lesson. The blocks below are not captured command output.

ip address show
Job: list IPv4 and IPv6 addresses assigned to interfaces.
The Ubuntu noble ip-address manual uses this command as an example.
A later run on your machine will show your interfaces. Do not copy those addresses into the question.

ss -ltn
Job: show listening sockets, limit the list to TCP, and print numeric ports.
This inspects sockets on the machine. It does not send a probe to another host.
Do not add -K. That option attempts to close sockets.

ping -c 2 127.0.0.1
Job: send two ICMP echo requests to the IPv4 loopback address, then stop.
Addresses of the form 127 and anything must not appear outside the host, so this probe stays on the sender.
This page shows no captured reply. A later run may print replies and times. Those lines were not recorded here.
If the command is refused, stop. Do not change permissions.

Activity listener card, fictional, not ss output
State   Local address
LISTEN  127.0.0.1:9090
Predict before reading the check. Check: the listening TCP port on this card is 9090.

Failed-echo card, fictional model. Do not send this probe.
Drawn probe: ping -c 2 203.0.113.10
Drawn result: no echo reply
Two hypotheses that fit the card, neither proven by the drawing:
1. The echo was filtered.
2. The sender had no route to that address.

Separate the requested job from the card value

A command question asks which operation fits, while an endpoint question
asks for data such as an address or port. Use the format the question
requests. Keep explanations in notes.

Notes beside the question. They do not replace the question text.

The question offers two commands. One inspects local sockets. One sends an echo request.
An address, a time, or an interface name from your machine is not the answer.
No echo reply can fit more than one cause. Silence does not, by itself, prove a host is powered off.

1. Match each worked job to addresses, local listeners, or an echo request.
2. On the activity listener card, name the TCP port.
3. Check: the listening TCP port on this card is 9090.
4. For the drawn probe ping -c 2 203.0.113.10 with no echo reply, keep both hypotheses: the echo was filtered, or the sender had no route. Do not send the probe and do not scan.

04Optional challenge

Allow about ten extra minutes. Imagine a system replies to an echo request but a page does not load. Explain why those results can coexist: an ICMP response and an application response answer different questions. Record a next question about the application without scanning or connecting.

05Stage case

Combine the synthetic stream, listener card and missing-echo card in one evidence note. Only the TCP stream is stored in network-observation.pcapng. The listener and echo cards are separate fictional descriptions, so do not claim you found them inside the capture.

The stream transcript supplies keep from desk and kept from shelf. The earlier 2026-10-12 TShark record reports those payloads with trailing newlines. Use the text to follow direction, then choose the kind of diagnostic suited to the listener question and the echo question.

Check your note: name each artifact's origin, both stream endpoints, the response word, the appropriate diagnostic job and two possible explanations for missing echo. State what remains unknown and whether you used printed reasoning or actual observations. Finish there without a scan or live capture.

The next stage adds names and web requests. DNS translates names into address information; an application then uses network endpoints to exchange messages. Carry forward the same habit: identify the evidence source and do not treat a working lower-level exchange as proof that the whole application succeeded.

Connect each conclusion to its source

The stream is synthetic. The listener and missing-echo cards are
separate fictional evidence. Only the TCP stream is in the pcapng file.
Identify the response direction, then choose the kind of diagnostic
that would inspect a listener or send an echo request. Do not send the
drawn probe. List possible causes without declaring one proven.

Historical file-read record, 2026-10-12: TShark 4.2.2 read keep plus
newline and kept plus newline from network-observation.pcapng. This was
a read of synthetic bytes, not live traffic or a Wireshark GUI session.

Traffic stage review case. Synthetic stream plus two fictional cards.
network-observation.pcapng serializes only the TCP stream.
The echo card and the listener card are not packets in that file.

Stream
desk 192.168.50.10 port 49170, shelf 192.168.50.23 port 9090
Setup: SYN, SYN-ACK, ACK
desk to shelf: keep
shelf to desk: kept
Predict before reading the check. Check word: kept

Listener card, not ss output
State   Local address
LISTEN  192.168.50.23:9090

Echo card. Do not send the probe.
Drawn probe: ping -c 2 203.0.113.10
Drawn result: no echo reply
Hypotheses that fit: the echo was filtered, or the sender had no route.
Silence does not prove the host is powered off.

Rubric
1. The stream response word is kept.
2. A question about the listener is answered by the socket-listing command. The echo command answers a different question.
3. Name two hypotheses for the missing echo. Do not scan, and do not capture a shared network.

1. Name the stream response word. Check word: kept.
2. The case asks which kind of command answers a listener question, and which kind answers an echo question. Use the jobs from this lesson. The required command question on this page is separate.
3. Name two hypotheses for the missing echo. Do not scan, and do not capture a shared network. The rubric in the file is the whole case.

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Need P: inspect addresses assigned to local interfaces.
Need Q: inspect local listening TCP sockets numerically.
Need R: send exactly two loopback ICMP echo requests, then stop.
This is command selection on paper.

Socket card, not literal command output:
LISTEN TCP 127.0.0.1:9174
No application response is supplied.
Separate echo card: no reply observed; routing and filtering facts are unknown. These are not packets in a capture file.

07Explain your prediction

Optional written self-check: State the command’s job and evidence origin. Keep local sockets, ICMP replies and application responses separate; list competing explanations and a missing fact that could distinguish them.