ping, traceroute, and mtr: network diagnostic commands in SSH

Remote network diagnostics from an SSH session require isolating latency, packet loss, and unresponsive intermediate routing hops. The standard utilities ping, traceroute, and mtr enable administrators to verify host reachability, inspect packet forwarding paths hop by hop, and detect intermittent transport bottlenecks or ICMP packet filtering across network interfaces.

Latency and reachability verification using ping -c

The ping command dispatches ICMP Echo Request datagrams to measure round-trip time (RTT) between two networked interfaces. When running remote interactive sessions, restricting execution with the -c count flag prevents infinite loops that could lock up the terminal prompt if signal handling fails:

# Transmit exactly 5 packets with a 2-second timeout per probe
ping -c 5 -W 2 192.0.2.1

# Adjust probe interval to 0.5 seconds (requires root privileges for intervals below 0.2s)
ping -c 10 -i 0.5 198.51.100.10

Managing infrastructure from a touchscreen keyboard makes interrupting an unconstrained ping sequence tedious. In dedicated tools like the termi1 SSH and Mosh terminal, the accessory row provides a hardware-style Ctrl+C key, allowing operators to send SIGINT immediately without toggling system keyboard layers.

Hop-by-hop path tracing using traceroute

The traceroute utility discovers layer-3 forwarding devices along the path toward a destination host by incrementally increasing the Time To Live (TTL) value of outgoing IP packets. Linux distributions implement traceroute using UDP datagrams directed toward high destination ports (33434 and above) by default, whereas BSD and Windows utilities rely primarily on ICMP.

# Numeric output without reverse DNS resolution to accelerate inspection
traceroute -n -q 2 -m 20 203.0.113.50

# ICMP Echo probes instead of default UDP datagrams
traceroute -I -n 203.0.113.50

# TCP SYN probing targeting default OpenSSH or HTTPS service ports
traceroute -T -p 22 -n 203.0.113.50

Using -n prevents sluggish reverse DNS lookups on unmapped gateway IPs, cutting execution time substantially. The -q 2 flag restricts probes to two attempts per hop, conserving bandwidth on constrained links.

Continuous packet loss analysis using mtr -rw

The mtr tool unifies the operational capabilities of ping and traceroute into an active link-state monitor. To collect reproducible benchmarks during outages or pipe clean outputs into trouble tickets, report mode without the interactive ncurses UI is the documented approach according to Linux man7 manual pages:

# Generate a 50-cycle static report with full hostname column widths
mtr -rw -c 50 198.51.100.25 > network_report.txt

# Audit routing hops using TCP probes targeted at OpenSSH port 22
mtr --tcp --port 22 -rw -c 30 198.51.100.25

The -r (report) parameter samples data across the cycle count defined by -c and renders a summary table displaying packet loss percentages (Loss%), average latency (Avg), and standard deviation (StDev). The -w (wide) option ensures intermediate hostnames are not truncated on compact screens. When operating inside tmux, long mtr sampling runs remain intact even if your mobile connection changes.

Diagnostic strategies when ICMP is blocked

Cloud edge firewalls and managed hosting providers regularly drop incoming ICMP traffic to minimize reconnaissance exposure. Failing ICMP probes do not indicate an offline host:

1. Switch to TCP SYN probes: Run traceroute -T -p 22 or tcptraceroute aimed at OpenSSH (which listens on TCP port 22 by default) to establish whether standard transport handshakes succeed.
2. Test endpoint sockets with netcat or curl: Verify direct TCP reachability using nc -zv -w 3 target 22 or test web listeners with curl -I https://target to eliminate layer-4 filtering ambiguities.
3. Differentiate UDP flows in Mosh environments: Mosh allocates UDP ports within the 60000–61000 range. If an initial SSH authentication succeeds but Mosh stalls, firewall rules permit TCP 22 while dropping necessary UDP traffic.
4. Leverage private mesh networks: When hosts lack public IP addresses or drop edge probes, tunneling through a mesh private network like Prialo or Tailscale bypasses perimeter filtering via encrypted peer-to-peer overlays.

Comparison of network diagnostic tools on mobile terminals

Selecting the right command depends on whether the technician requires instant status, routing path verification, or statistical evidence:

When executing these checks on mobile devices, termi1 allows natural-language command generation that drafts complete syntax into the shell prompt without pressing Enter, keeping engineers in total control of network diagnostic routines.

Frequently asked questions

Why does ping report packet loss while web applications load normally?

Network routers and server kernels assign lower CPU processing priority to incoming ICMP Echo packets compared to TCP traffic. Moderate ICMP loss frequently indicates localized control-plane rate limiting on an intermediate router rather than genuine transport degradation affecting application services.

How should continuous asterisks in traceroute hops be interpreted?

Asterisks in traceroute output signify that an intermediate gateway did not return a response within the configured timeout window. This behavior commonly indicates that the router administrator has disabled ICMP Time Exceeded generation or filtered UDP probes per security policy.

What is the functional difference between interactive mtr and mtr -rw?

Standard interactive mtr dynamically repaints terminal buffers via ncurses, which consumes unnecessary bandwidth over low-throughput remote connections. The -rw flags suppress interactive redrawing, collect probes over a specified cycle count, and format a clean text table suitable for scripting.

Why does traceroute fail while an existing Mosh session stays connected?

Mosh operates over UDP datagrams assigned between ports 60000 and 61000 after authenticating via OpenSSH on TCP 22. If network firewalls filter standard ICMP or unassigned UDP probe ranges, traceroute requests get dropped while designated Mosh UDP traffic passes unobstructed.