Ping (networking utility)
| Company type | Software utility |
|---|---|
| Industry | Computer networking |
| Founded | December 1983 |
| Founder | Mike Muuss |
| Headquarters | United States |
| Products | Network diagnostic tool |
Ping is a computer network management software utility designed to verify the accessibility of a host within an Internet Protocol (IP) network. It is widely supported across numerous operating systems, including those with embedded network management tools.
The utility calculates the round-trip time for packets sent from the source to a specified destination and back again. Its name is inspired by terminology from active sonar, where a signal is transmitted and its echo is received.
Ping functions by utilizing Internet Control Message Protocol (ICMP) packets, dispatching an ICMP echo request and waiting for an ICMP echo reply. It provides feedback on errors, packet loss, and performance metrics such as minimum, maximum, average round-trip durations, and standard deviation.
Command-line options differ depending on the implementation and may allow adjustments to payload size, number of test packets, network hops (TTL), intervals between requests, and timeout periods. Additionally, many platforms include a related tool called ping6 for conducting tests on Internet Protocol version 6 (IPv6) networks using ICMPv6.
History
Developed in December 1983 by Mike Muuss at the Ballistic Research Laboratory, now known as the US Army Research Laboratory, Ping was created following a recommendation from David Mills to assist in diagnosing IP network problems. The name refers to sonar echolocation rather than being an acronym, although the backronym Packet InterNet Groper has been popularly adopted. Muuss credits Mills for this interpretation but highlights the original sonar inspiration.
The first version was released into the public domain; subsequent editions have been distributed under the BSD license. Ping was initially introduced in 4.3BSD. The FreeDOS variant, authored by Erick Engelke, is licensed under the GPL, whereas Tim Crawford’s ReactOS adaptation uses the MIT License.
For Ping to operate correctly, all hosts must support processing and responding to ICMP echo requests.
Invocation example
Below is an example of executing ping on a Linux system, sending five probes at default one-second intervals (modifiable via -i) to www.example.com:
<syntaxhighlight lang="console"> $ ping -c 5 www.example.com
PING www.example.com (93.184.216.34): 56 data bytes 64 bytes from 93.184.216.34: icmp_seq=0 ttl=56 time=11.632 ms 64 bytes from 93.184.216.34: icmp_seq=1 ttl=56 time=11.726 ms 64 bytes from 93.184.216.34: icmp_seq=2 ttl=56 time=10.683 ms 64 bytes from 93.184.216.34: icmp_seq=3 ttl=56 time=9.674 ms 64 bytes from 93.184.216.34: icmp_seq=4 ttl=56 time=11.127 ms
--- www.example.com ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 9.674/10.968/11.726/0.748 ms </syntaxhighlight>
This output displays each individual probe’s result followed by summary statistics indicating that the shortest round-trip duration was 9.674 ms, the average was 10.968 ms, the longest was 11.726 ms, and the standard deviation measured 0.748 ms.
Error indications
In cases where the target host fails to respond, most versions either produce no output or display periodic timeout messages. Typical error notifications indicating network problems include:
- , , — unreachable host, network, or protocol
- — failure in source routing
- — fragmentation required but not allowed
- , — unknown destination network or host
- — isolated source host
- — administrative prohibition on communication with destination network
- — administrative prohibition on communication with destination host
- — destination network unreachable for specified ToS
- — destination host unreachable for specified ToS
- — communication blocked administratively
- — violation of host precedence
- — precedence cutoff enforced
When such errors occur, either the target or an intermediary router returns an ICMP error message (such as host unreachable or TTL exceeded in transit). These responses contain the first eight bytes of the original packet’s header to enable Ping to correlate replies with their corresponding requests.
ICMP packet encapsulated in IPv4
The format of an ICMP packet carried over IPv4 is organized as follows:
The ICMP Echo Request packet contains these essential components:
Key elements:
- Type
- 8 signifies an 'Echo Request'.
- Checksum
- a 16-bit one's complement checksum calculated over the ICMP message starting from the Type field, excluding the IP header.
- Identifier
- serves to correlate replies with their corresponding requests.
- Sequence number
- used to maintain the order of requests.
- Payload
- optional data section with variable length.
On Linux platforms, each ping process is assigned a unique Identifier, while the Sequence number increments with each request. In contrast, Windows systems utilize a fixed Identifier (which differs by version) and reset the Sequence number only upon system reboot.
The Echo Reply packet is structured similarly, with:
Significant fields:
- Type
- 0 indicates an 'Echo Reply'.
- Identifier and Sequence number
- duplicated from the original Echo Request.
- Payload
- replicated from the Echo Request.
This ICMP packet format forms the backbone of network diagnostic utilities vital for managing and troubleshooting enterprise networks.
ICMPv6 packet encapsulated in IPv6
An ICMP packet transmitted via IPv6 follows this structure:
Linux systems generally assign a unique Identifier for each ping process, incrementing the Sequence number accordingly. Windows maintains a fixed Identifier (varying by version) and resets the Sequence number only after rebooting.
The corresponding Echo Reply packet has the following arrangement:
Payload
Typically, the payload consists of ASCII text, as observed in tcpdump outputs, and may include timestamps along with sequence numbers to facilitate stateless calculation of round-trip times.
In some cases, it carries a magic packet used for Wake-on-LAN functionality, which requires a larger payload size. Usually, hosts in hibernation do not respond to Echo Requests, but if configured for network wakeup, they can be awakened by such packets. Hosts that are awake and set to reply will echo back the identical payload, allowing detection of wake-up events.
Devices in low-power active states might respond immediately without fully waking hardware components. This behavior supports energy-efficient network responsiveness and helps avoid deeper sleep modes that have longer wake-up delays.
To prevent fragmentation, packets combining IP and ICMP headers must remain within the maximum transmission unit limits of the network.
Security vulnerabilities
Malicious actors may misuse ping requests in denial-of-service attacks by flooding targets with rapid ICMP echo requests—a method known as a ping flood. Furthermore, ping sweep techniques scan multiple IP addresses to discover active devices on a network.