32
14
Using cmd and ping on Windows gave me the following results:
Aren't both situations exactly the same?
I mean, I'm pinging the same interface, the same machine and the same address. Why do I get such different results?
EDIT: Here is my ipconfig /all screen:
Diogo
Posted 2012-04-18T19:23:11.910
Reputation: 28 202
46
You are not pinging the same interface, without any physical interfaces you still have a "local host".
Your localhost is used to refer to your computer from its "internal" IP, not from any "external" IPs of your computer. So, the ping packets don't pass through any physical network interface; only through a virtual loop back interface which directly sends the packets from port to port without any physical hops.
You might still wonder why localhost is resolving to ::1, while traditionally we would expect it to resolve to the IPv4 address 127.0.0.1. Note that .localhost is traditionally a TLD (see RFC 2606) which points back to the loop back IP address (for IPv4, see RFC 3330, especially 127.0.0.0/8).
Looking up localhost using nslookup gives us:
nslookup localhost
...
Name: localhost
Addresses: ::1
127.0.0.1
Thus Windows prefers to use the IPv6 loop back IP address ::1 (see RFC 2373) as it is listed first.
Okay, so, where does it come from, let's look at the hosts file.
type %WINDIR%\System32\Drivers\Etc\Hosts
...
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
...
Hmm, we have to look at the DNS settings of Windows.
This KB article tells us about a setting that affects what Windows prefers, emphasized in bold:
In Registry Editor, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\ParametersDouble-click DisabledComponents to modify the DisabledComponents entry.
Note: If the DisabledComponents entry is unavailable, you must create it. To do this, follow these steps:
In the Edit menu, point to New, and then click DWORD (32-bit) Value.
Type DisabledComponents, and then press ENTER.
Double-click DisabledComponents.
Type any one of the following values in the Value data: field to configure the IPv6 protocol to the desired state, and then click OK:
- Type
0to enable all IPv6 components. (Windows default setting)- Type
0xffffffffto disable all IPv6 components, except the IPv6 loopback interface. This value also configures Windows to prefer using Internet Protocol version 4 (IPv4) over IPv6 by modifying entries in the prefix policy table. For more information, see Source and Destination Address Selection.- Type
0x20to prefer IPv4 over IPv6 by modifying entries in the prefix policy table.- Type
0x10to disable IPv6 on all nontunnel interfaces (on both LAN and Point-to-Point Protocol [PPP] interfaces).- Type
0x01to disable IPv6 on all tunnel interfaces. These include Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), 6to4, and Teredo.- Type
0x11to disable all IPv6 interfaces except for the IPv6 loopback interface.Restart the computer for this setting to take effect.
What is this prefix policy table?
netsh interface ipv6 show prefixpolicies(orprefixpolicyon earlier versions)
Precedence Label Prefix
---------- ----- --------------------------------
50 0 ::1/128
45 13 fc00::/7
40 1 ::/0
10 4 ::ffff:0:0/96
7 14 2002::/16
5 5 2001::/32
1 11 fec0::/10
1 12 3ffe::/16
1 10 ::/96
This table decides what prefixes get precedence over other prefixes during DNS resolves.
Ah, so using that KB we could add entries here that denote that IPv4 has higher precedence than IPv6.
Note: There is no reason to override this behavior, unless you are experiencing compatibly problems. Changing this setting on our Windows Server broke our mail server, so it should be handled with care...
Tamara Wijsman
Posted 2012-04-18T19:23:11.910
Reputation: 54 163
Actually 'localhost' is not a top-level domain, but a hostname. The distinction is extremly subtle, but basically every domain name is a hostname, but not all hostnames are domain names. By convention, hostnames ending in a ful stop must be FQDN, and most hostnames not ending in a full stop can be converted to FQDN by appending the parent domain, falling back to appending the root if need. However, those are just conventions. 'localhost' is reserved by RFC 2606, to prevent it from becoming a TLD, since it is likely to not work right, and may even cause problems. – Kevin Cathcart – 2012-04-18T21:02:32.077
2Incorrect, as RFC 2606 mentions: The ".localhost" TLD has traditionally been statically defined in host DNS implementations as having an A record pointing to the loop back IP address and is reserved for such use. Note the use of TLD and note that is traditionally defined. In fact, ping localhost. works which confirms that this is at least true in the context of this question. Your very last sentence is not what the RFC said, please quote if it does "prevent it from becoming a TLD" because by what it says it is traditionally a TLD. Else they wouldn't refer to the .localhost TLD – Tamara Wijsman – 2012-04-18T21:17:12.560
I was a bit too strong. localhost can be a TLD if an actual DNS server responds for it, but generally localhost is generally defined as a hostname in /etc/hosts, in which hostnames are looked up prior to attempting to resolve via DNS. As such dig localhost usually does not return an "A" record for 127.0.0.1, or an AAAA record for ::1. That means the RFC is mistaken when it says traditionally been statically defined in host DNS implementations, but rather get returned by the system's name lookup service, which does not always use the DNS. – Kevin Cathcart – 2012-04-19T18:57:04.693
@KevinCathcart: We're in a Windows question here, and the Windows versions mentions this is done by DNS itself. nslookup does return records. So, YMMV... – Tamara Wijsman – 2012-04-19T19:41:09.477
1@KevinCathcart my dig returns A, AAAA, and NS records for localhost, including an authority record for: localhost. IN NS localhost. – KutuluMike – 2012-04-20T00:30:02.387
He's pinging the same interface, the loopback interface, in both cases. Ethernet interfaces only handle Ethernet traffic, they do not handle traffic that never involves an Ethernet packet and never goes over a wire. – David Schwartz – 2012-04-20T22:37:09.987
20
The loopback interface exists independently of your Ethernet interface(s).
Even without the complication of IPv6 you'd have two distinct addresses.
Loopback IPv4 address : 127.0.0.1
Your Ethernet interface's IPv4 address : 192.168.0.10
The loopback interface might well be in a different software layer, more remote from real hardware. I doubt it depends in any way on your specific Ethernet interface driver for example.
RedGrittyBrick
Posted 2012-04-18T19:23:11.910
Reputation: 70 632
11
Localhost and your IP address are not the same thing.
The localhost is a special software only IP Address, that is linked to your system. Localhost, or 127.0.0.1, is a loop back address. It always points to your system, and is only accessible from your computer. This routing occurs at the OS level, and definitely never leaves the NIC... So there is no chance for it to hit the network....
Pinging your own IP address is similar but it potentially involves the entire networking stack, since it needs to detect that it is your IP address, and route it correctly...
The effect should be the same, but there can be differences.
For example, unplug your network cable. Ping your static IP address. You may get no route to host, or other errors. Now ping localhost or 127.0.0.1, and it will work.
Benjamin Schollnick
Posted 2012-04-18T19:23:11.910
Reputation: 4 313
So, ping localhost is complete useless? I mean, if I want to test my interface.... – Diogo – 2012-04-18T19:57:16.703
4@DiogoRocha correct, ping localhost does not touch the hardware ever. Heck ping 192.168.0.10 may not give you a reliable info too if the network card's driver intercepts requests given to itself. – Scott Chamberlain – 2012-04-18T20:15:07.023
@DiogoRocha Your terminology is off. 127.0.0.1 is an interface, but a virtual one. – barlop – 2012-04-19T12:29:31.290
@Diogo, Not quite. Localhost allows you to test the network behavior of an application, or verify that the network stack is working.... But it doesn't test the driver. So for example, if you have a bad NIC Driver, localhost might be able to help prove it's the nic driver. Your mileage will definitely vary though!! – Benjamin Schollnick – 2012-05-16T19:32:30.763
6
I realize from the screenshots this question isn't about Linux, but it perhaps makes a useful "case in point".
On that OS, if you ping one of your local adapter addresses, it is translated to the loopback device (special case hack). This means that the packets actually go to the loopback device (which has all the implications you might think: for instance from a firewalling point of view, those packets are coming in on the loopback interface and will match rules for that interface).
The device to which the IP is assigned will never see the packets. (This is good because it would not do the right thing with those packets: it would want to send the suckers out.)
However, if the interface which holds that IP should happen to go down, you've lost that connection. The mapping to loopback will stop working.
So in other words, it is a workable design to regard those local addresses to be aliases for the loopback device.
Code references:
http://lxr.linux.no/#linux+v3.3.2/net/ipv4/route.c#L2623
Take a look at function ip_route_output_slow. This calls fib_lookup, and if this function returns the code RTN_LOCAL, dev_out is rewritten to loopback:
Kaz
Posted 2012-04-18T19:23:11.910
Reputation: 2 277
4
It looks like the "Localhost" alias is resolving to the IPv6 loopback and when you explicitly use an IPv4 address obviously it doesn't.
EBGreen
Posted 2012-04-18T19:23:11.910
Reputation: 7 834
My Ethernet Adapter have no IPV6 adress configured on it. Actually IPV6 is disabled on the wired interface. – Diogo – 2012-04-18T19:28:14.523
6The OS appears to disagree with you. – EBGreen – 2012-04-18T19:28:46.923
6It doesn't matter, it's apparently set up for the computer, localhost is hitting the ipv6 loopback. – Rob – 2012-04-18T19:58:34.830
1@DiogoRocha There is no such address ::1 in IPV4 world. 127.0.0.1 is the IP reserved for the loopback there. ::1 however DOES exist for IPV6, and like 127.0.0.1, is reserved for IPV6 loopback. – Andy – 2012-04-18T20:51:45.540
@DiogoRocha the loopback address doesn't go through a physical interface, so as long as your OS has IPv6 enabled it can be mapped to it. In Windows for instance, the mapping is done via a config file. – Danny – 2012-04-19T01:18:48.500
4How does this answer the question? You're just stating the obvious. – Tamara Wijsman – 2012-04-19T06:52:20.757
4Please elaborate on your answer, this doesn't really explain anything – Ivo Flipse – 2012-04-19T07:24:01.713
so ::1 is the IPv6 loopback address. good to know. – barlop – 2012-04-19T12:56:40.507
1
@ebwhite is right about what.
Now, the why might be that you have Teredo set up (I can't tell from your screenshot, piping it to a text file and pasting the whole output is better) - the behaviour of localhost being IPv6 is consistent with the systems on my IPv4 only network with teredo installed, but systems without it behave as you expect it to getting 127.0.0.1 when you ping localhost. I've tested this with Windows XP and need to see what my Windows 7 systems do and update the question.
Generally, systems default to IPv6 if IPv6 is available so, your system is working as it should by-design.
Journeyman Geek
Posted 2012-04-18T19:23:11.910
Reputation: 119 122
he doesn't get Bytes transferred or TTL, with one of the screenshots, is that IPv6? why? – barlop – 2012-04-19T12:32:05.437
also consistant with what i see on windows 7 - my guess is the round trip time is negligible – Journeyman Geek – 2012-04-19T12:33:53.463
18You are not pinging the same interface, even without any physical interfaces you still have a "local host". – Tamara Wijsman – 2012-04-18T20:31:17.953
If by "the same interface", you mean the loopback interface, you are correct. If you mean the Ethernet interface, you are wrong for several reasons. (For example, how is ::1 associated with the Ethernet interface? And why would the Ethernet interface -- whose job is to send Ethernet packets on the wire and receive them from the wire -- be involved in an operation that never involves an Ethernet packet or a wire?) – David Schwartz – 2012-04-18T21:47:12.697
I'm fairly certain this question has been asked on Stackoverflow before, if I can find it... – Chris S – 2012-04-18T22:28:09.747
The heart of this gets answered by this SO, I believe: http://stackoverflow.com/questions/6938039/localhost-vs-real-ip-address
– Dawson Toth – 2012-04-19T02:45:20.060I think the interesting thing is: why do you get a number of bytes transferred and a TTL when pinging a remote host, but neither when pinging localhost? Nobody likely cares that the IP address format is a bit off. – dhasenan – 2012-04-19T03:14:53.833
On mine I get Bytes transferred and with both. I don't know if the difference with yours is IPv6 related – barlop – 2012-04-19T12:26:40.170
@David Schwartz The Loopback is an interface to a network. That is the internal network which does not need a Ethernet Interface, hence Tom Wijsman was correct. – David Allan Finch – 2012-04-20T09:13:02.583
@DavidAllanFinch: There is only one loopback interface, and it handles all IP traffic that is strictly local to the machine. How is it correct to say that "you are not pinging the same interface"? – David Schwartz – 2012-04-20T18:15:20.713