ping is a computer network tool used to test whether a particular host is reachable across an IP network; it is also used to self test the network interface card of the computer, or as a speed test. It works by sending ICMP “echo request” packets to the target host and listening for ICMP “echo response” replies. Ping measures the round-trip time and records any packet loss, and prints when finished a statistical summary of the echo response packets received, the minimum, mean, max and in some versions the standard deviation of the round trip time.

The word ping is also frequently used as a verb or noun, where it is usually incorrectly used to refer to the round-trip time, or measuring the round-trip time.

The tool is used in a simple denial-of-service attacks, known as a ping flood, in which the attacker overwhelms the victim with ICMP echo request packets.

History

Mike Muuss wrote the program in December, 1983, as a tool to troubleshoot odd behavior on an IP network. He named it after the pulses of sound made by a sonar, since its operation is analogous to active sonar in submarines, in which an operator issues a pulse of energy at the target, which then bounces from the target and is received by the operator. (The pulse of energy in sonar is analogous to a network packet in ping).

The usefulness of ping in assisting the "diagnosis" of Internet connectivity issues was impaired from late in 2003, when a number of Internet Service Providers began filtering out ICMP Type 8 (echo request) messages at their network boundaries.

This was partly due to the increasing use of ping for target reconnaissance, for example by Internet worms such as Welchia that flood the Internet with ping requests in order to locate new hosts to infect. Not only did the availability of ping responses leak information to an attacker, it added to the overall load on networks, causing problems for routers across the Internet.

Although RFC 1122 prescribes that any host must accept an echo-request and issue an echo-reply in return, this is supposedly a security risk. Thus, hosts that no longer follow this standard are frequent on the public Internet.

Generic composition of an ICMP packetRFC 792

• Header (in blue):
• Protocol set to 1 and Type of Service set to 0.
• Payload (in red):
• Type of ICMP message (8 bits)
• Code (8 bits)
• Checksum (16 bits), calculated with the ICMP part of the packet (the header is not used)
• The ICMP 'Quench' (32 bits) field, which in this case (ICMP echo request and replies), will be composed of identifier (16 bits) and sequence number (16 bits).
• Data load for the different kind of answers (Can be an arbitrary length, left to implementation detail. However must be less than the maximum MTU of the network Fact: date=December 2008).