The plain ping 3.3.3.3 on a Cisco router tests one thing: the path from the router's egress interface to the target. That is often not the question you actually need answered. Extended ping lets you control the source address, packet size, DF bit, repeat count, and timeout, which turns ping from a reachability check into a precision instrument for testing return paths, MTU, and route symmetry. This article covers the options that matter and the response characters that tell you what failed, with every capture taken live from IOS XE routers in CML. It is part of the PingLabz ping guide.
Why the Source Address Matters
When R1 pings R3's loopback with defaults, the packet is sourced from R1's outgoing interface (10.0.12.1). R3's reply only has to find its way back to the 10.0.12.0/30 link, which is directly connected to R3's neighbor. That test can pass while half your network is unreachable.
Source the ping from R1's loopback instead, and now R3 must have a working route back to 1.1.1.1. You are testing the return path, which is where routing problems hide:
R1#ping 3.3.3.3 source Loopback0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/4 msThis is the single most useful extended option. If ping X works but ping X source Loopback0 fails, the far side is missing a route to your loopback (or to whatever prefix you sourced from). In BGP and OSPF troubleshooting, sourcing from loopbacks is standard practice because that is what your routing protocol sessions and management traffic actually use.
One-Line Extended Ping
You do not need the interactive dialog for most work. IOS accepts the common options inline:
ping 3.3.3.3 source Loopback0
ping 3.3.3.3 size 1500 df-bit
ping 3.3.3.3 repeat 100 size 1000
ping 3.3.3.3 repeat 500 timeout 1
ping vrf MGMT 10.10.10.1A high repeat count with a bigger payload is a quick-and-dirty link quality test. Here is 100 pings at 1000 bytes across two routed hops:
R1#ping 3.3.3.3 repeat 100 size 1000
Sending 100, 1000-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 2/3/4 msAnything less than 100% on a healthy internal path deserves investigation (Cisco's own guidance treats a success rate under 80 percent as problematic).
DF Bit and Size: MTU Testing From the Router
The path from R1 to R3 crosses a link deliberately configured with ip mtu 1400. Send a full-size packet with the DF bit set and watch it die:
R1#ping 3.3.3.3 size 1500 df-bit
Sending 5, 1500-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with the DF bit set
M.M.M
Success rate is 0 percent (0/5)M means "could not fragment": a downstream router needed to fragment the 1500-byte packet to fit the 1400-byte link, and the DF bit forbade it. The full MTU-hunting method (including finding the exact path MTU by binary search) is covered in ping and MTU testing.
Response Characters, Decoded
Every probe in an IOS ping prints exactly one character. Memorize the six you will actually see:
Real patterns are more informative than single characters. Here is R1 pinging a target behind an ACL that denies ICMP echo:
R1#ping 3.3.3.3
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)Why U.U.U and not UUUUU? IOS rate-limits ICMP unreachables to one per 500 ms by default, so every other probe gets an unreachable and the ones in between time out. Alternating patterns like this are a signature of rate-limited ICMP errors, not flapping. Compare a plain no-route timeout, which produces only dots:
R1#ping 10.99.99.99
Sending 5, 100-byte ICMP Echos to 10.99.99.99, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)The Interactive Dialog
Type ping with no arguments in privileged EXEC and IOS walks you through every option: protocol, target, repeat count, datagram size, timeout, extended commands (source, ToS/DSCP, DF bit, validate, data pattern, IP header options), and sweep. Two capabilities live only in this dialog:
Sweep range of sizes. Answer y to sweep and set min/max/interval, and IOS sends probes at every size in the range. It is the exhaustive way to find the exact MTU ceiling on a path (each size that fits returns !, each size that does not returns M with DF set).
Data pattern. Useful on suspect serial or optical links: patterns like 0x0000, 0xFFFF, and 0xAAAA can catch line-coding and clocking problems that a default pattern misses.
Record route. Under IP header options, Record stores up to nine hop addresses in the packet, including the return path (something traceroute cannot show you). Modern networks often filter packets with IP options, so treat it as a lab tool.
The Companion: Extended Traceroute
The same source-address logic applies to traceroute, and the numeric form belongs in your muscle memory:
R1#traceroute 3.3.3.3 numeric
Tracing the route to 3.3.3.3
1 10.0.12.2 3 msec 2 msec 2 msec
2 10.0.23.1 3 msec * 4 msec(That lone * on the final hop is the same ICMP rate-limiting you saw above, not packet loss.) IOS traceroute sends UDP probes with incrementing TTLs and reads the ICMP time-exceeded messages that come back; its response characters differ from ping's (A = administratively prohibited, H = host unreachable, P = protocol unreachable, * = timeout).
Key Takeaways
- Default ping sources from the egress interface and barely tests the return path.
source Loopback0is the option that finds real routing problems. - One-liners cover source, size, df-bit, repeat, timeout, and VRF. The interactive dialog adds sweep, data patterns, and record route.
!reply,.timeout,Uunreachable,Mcould not fragment. Patterns likeU.U.Ucome from ICMP unreachable rate-limiting (1 per 500 ms).size 1500 df-bitproducingM= a sub-1500 MTU link on the path.- Success below 100% on an internal path is a finding, not a rounding error.
Next: hunting path MTU with ping, or browse the full ping guide.
