How does a computer know when it is online and when not?

Question

I was working on my router firmware today and needed to reboot it to complete the update. Then I noticed my internet was disconnected for a minute and computer came back online when the boot was complete. How did it know the it's online so precise?
Does it run continuous ping tests to your gateways and then to the internet somewhere? If so, can this in anyway cause a ping-of-death on some server in the world?

Answer 1

You can be “disconnected” in several different ways, so how it detects that you are disconnected can vary:

• Physically disconnected cable

  If your wired connection becomes physically disconnected, then obviously the NIC will know that the circuit has been cut. This is like a light turning off because it gets unplugged.

• Logically disconnected cable

  If your wired connection becomes logically disconnected (the cable is still plugged in, but the modem or router is turned off), then the NIC still knows because the circuit has still technically been cut. This is like the light still being plugged it, but the power goes out. You’ll also notice the link-status LED on the NIC (figure 1) and on the router (figure 2) turn off.

• Logically disconnected wireless

  It’s a little more complex with a wireless connection. If the wireless modem or router goes out, the wireless adapter can detect the lost connection because even though there is no physical connection, the radio-waves still behave like a direct, physical connection, and the circuitry in the NICs radio module is designed to be able to detect a wireless signal, or lack thereof. (Of course the specifics go beyond the scope of this site and are better suited to Electrical Engineering.)

• Disconnected from Internet

  Another way that you can experience disconnection is from the Internet at large. This is similar to logical disconnection because the network-adapter is still connected. What’s differnt is that in this case, even the modem or router is still be on and active, and you can even access the local network if one exists. This is indeed determine by pinging, but not the gateway, but rather a server outside the network; that is, something on the Internet.

  In Windows, starting from Vista, whether you are connected to the Internet or not is done by regularly pinging a Microsoft server. This is done by the NCSI, not to be confused with the television show with a similar acronym. The Network Connectivity Status Indicator is a Windows function which fetches a dummy file from one of two Microsoft URLs (depending on whether you are using IPv4 or IPv6). If it can get the file, it does nothing, but if it fails, then it indicates a lack of Internet connection (figure 3).

  It is only supposed to do this once in a while though, not continuously (see the Triggers section of the NCSI page), however some people have found it happens more than once in a while (though this is probably due to a flaky connection which keeps rec-on so Windows keeps re-checking). Nevertheless, you can change it to your own server or disable it outright.

---

Figure 1: Link LED on an Ethernet port

Figure 2: Connection LEDs on a router

Figure 3: Microsoft’s NCSI service reporting a lack of Internet connection

Answer 2

Does it run continuous ping tests to your gateways and then to the internet somewhere?

No.

It's not like you need an Internet connection for the computer to be able to detect whether or not it's connected to a network itself. Try unplugging the cable between your router (or broadband modem) and the larger world; you'll notice that the computer doesn't notice any disconnection, because as far as it is concerned, you're still connected to a network. That the network won't let you access one particular network (the Internet) is a very different matter. (You can use exactly the same technologies and exactly the same equipment as is used on the Internet to build a completely separate network. It wouldn't be the Internet, but for a computer, unless you probe for an actual specific known host with specific known properties, it would be completely indistinguishable from the Internet.)

Or take any random powered network switch and connect a network cable between it and your computer, but nothing else; there's a link, according to the computer, but it'll get you absolutely nowhere at all.

What the computer does detect is the loss of the electrical link on the network port. Technically, it detects the loss of the physical or possibly the data link layer link. That fact is (simplified explanation here) reported by the hardware to the operating system which can then report it to the user in any way it sees fit, including not at all.

For example, plain Linux just emits something much like kernel: networkdriver 0000:02:00.0: eth0: link down (where 0000:02:00.0 is a system hardware identifier for the network card, and eth0 is a logical identifier) into the system log. Userspace applications like for example NetworkManager can take the same information and report it in a more user-friendly form. Windows will, if a user is logged in, take largely the same information but display it in a popup message saying something along the lines of "network disconnection detected".

Answer 3

No constant pinging needed

Your computer first detected loss of ethernet layer connectivity - meaning electrical current was no longer present on its ethernet port (physical socket where the cable is plugged in). You will also notice the green light by the ethernet port went off - this happens when ethernet cable is pulled out from either of the 2 ends. Later when your router went back online, the electricity was detected first and the light went green. Very shortly after that also the icon in your PC system tray showed that network connection is working. At that point IP layer can be said to be operational and the computer knows can send and receive IP packets as it knows it can connect to the router.

Have a look at OSI network layer model. http://en.wikipedia.org/wiki/OSI_model

The answer is that ping program operates on network layer level, but your computer (as a system using its different parts integrated by the software) is "aware" of all the layers. So if the most basic layer is disrupted upon disconnecting the wire - that happens at the physical layer level (on the wire - most usually Ethernet). The network adapter is constantly receiving sending signals on the physical layer. You can compare it to the carrier on analogue telephone network. If you pick up a landline telephone receiver you can hear the carrier tone. If you don't hear it, you know the telephone line is not working. Similarly computer "knows" the ethernet wire is disconnected at either end, because there is no "carrier" (if we use this simile). So there is no need to constantly use ping for the computer to know it is connected to a physical network.

Also remember when we speak of ping we are only talking about TCP/IP protocol stack (particularly its ICMP protocol). To illustrate how internet connections work for web browsers, consider this. Typically when your Firefox browser wants to fetch a page from an URL (e.g. http://tinyurl.com) it first asks the computer what is the IP address of tinyurl.com. The system using its resolver library then queries a DNS server who gives the answer such as 195.66.135.249. Firefox then asks your computer to get the default webpage from tinyurl.com. Your computer establishes a TCP connection with the computer with IP 195.666.135.249 and delivers the http protocol message asking for the default webpage. tinyurl.com then sends back the default page over the http protocol that travels the virtual "pipeline" created by TCP protocol. This perhaps gives you a feel how different parts of TCP/IP protocols interoperate and illustrates that there are multitude of ways how a computer can "know" if it is connected to physical network, to local network and to the Internet.

For better concept of layers, you perhaps should look at some diagrams and more theory at http://www.hardwaresecrets.com/article/The-OSI-Reference-Model-for-Network-Protocols/431/1. The key idea would be that protocols on each level can "pretend" to talk to the same level protocol on the remote computer and do not really need to know much about other protocols, only how to receive/pass messages to the upper/lower level protocols. I am sure you will find analogy with letters stuffed in each other, quite handy.

You will see in OSI model - TCP/IP suite are not the only network protocols around. Some years ago Netware IPX/SPX protocols were better established in office networking settings and TCP/IP was a newcomer of sorts. The cable then often was coaxial not ethernet twisted pair.