Card 08/ 10
A Successful ping Does Not Mean the Service Is Up
ping proves a host answers at layer 3, and says nothing about the port or the program behind it.
A reply to ping shows that a host is reachable at the network layer and that ICMP is allowed on the path. It says nothing about whether a particular port is open or whether the program that should answer on it is running, because ping replies come from the operating system, not from the service.
Picture a monitoring check that pings a web server every minute and reports it healthy. During an outage, the check stays green for an hour: the web server process had crashed, but the machine was still up, so its operating system kept answering every ping.
The symptom. Ping replies normally, yet the website does not load. Requests to the service fail with "connection refused" or time out, while the monitoring dashboard shows the host as up.
pinglayer 3, answered by the operating system
The host has a working address and route, the path lets ICMP through, and the operating system is running. Nothing above layer 3 is touched.
A request to the servicelayers 3 to 7, answered by the program
Everything ping tests, plus a firewall that allows the port, a program listening on it, TLS if used, and an application that can produce a response.
Why it happens. ICMP echo is handled inside the operating system's network code. No application is involved, so a crashed server, a stopped database or a full disk leaves ping untouched. The reverse fault is just as common: many cloud firewalls and corporate networks block ICMP, so a perfectly healthy server never answers ping at all.
What it costs. A check built on ping misses the outages users notice and raises alarms for healthy hosts that drop ICMP. Engineers who trust it spend the first minutes of an incident convinced the server is fine.
What to do instead. Test the layer you care about. For a port, try to open a connection to it, with nc -vz host 443 for example. For a web service, send a real request to a health endpoint and check the response. Use ping only for the question it answers: is this address reachable on the network at all.
← → move through sections and cards