ping, ping6

send ICMP ECHO_REQUEST to network hosts

£ indicates a different meaning for linux, for mac

ping [ -LRUbdfnqrvVaAB] [ -c count] [ -i interval] [ -l preload] [ -p pattern]
      [ -s packetsize] [ -t ttl] [ -w deadline] [ -F flowlabel] [ -I interface]
      [ -M hint] [ -Q tos] [ -S sndbuf] [ -T timestamp option] [ -W timeout] [ hop ...]           destination

Send ICMP ECHO_REQUESTs (type 8) which elicits an ICMP ECHO_RESPONSE from a host or gateway.

The objective is to validate connectivity and minimaly qualify the interaction between the local host and a destination and all components in between.
No authentiation is used.

    If the ping is sucessful then the:
  1. Basic IP module in all hosts/gateways/switches/bridges/routers and the destination involved are installed and configured.
  2. Network Interface Cards are installed and operational
  3. Cables are connected
  4. Routing information is (minimally) correct.
  5. IF a destination host name was used then name resolution, either by /etc/hosts or by a Domain Name Server, is working (at least for that destination).
  6. The destination is alive, at least with respect to the network interface hardware and net interface protocol stack.
Some hosts/routers consider the request a security probe and do not respond!

Basic usage

> ping
PING ( 56(84) bytes of data.
64 bytes from ( icmp_seq=1 ttl=244 time=83.2 ms
64 bytes from ( icmp_seq=2 ttl=244 time=101 ms
64 bytes from ( icmp_seq=3 ttl=244 time=166 ms
64 bytes from ( icmp_seq=4 ttl=244 time=87.3 ms ^C

--- ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 83.258/109.508/166.406/33.506 ms
RTT is round trip time, mdev is the maximun deviation

Since each ping packet may be transfered via a different set of intermediate nodes there will be variations in times, TTL and even the succcess or failure from one ping to the next.

BSD (Mac OS X) only options are in this rendition
BSD does not suppport options in this rendition

-a audible. beep is sounded for each packet received (unless -q)
-A £ Audible NOT. Beep is sounded when no packet is received before the next packet is transmitted or not at all
For round-trip times that are longer than interval, further missing packets cause a bell only if the maximum number of unreceived packets has increased.
-q quiet. Only initial PING host (IP) … message is displayed.
Pressing the status key (frequently ^T ) displays progress.
Statistics are displayed when complete.
-QSomewhat Quiet output. Don't display ICMP error messages. Probably a bad idea.
-v Verbose output. (May not be any different)
-c count send count ECHO_REQUESTs.
Default: not limit
With deadline option(-w waits until the timeout expires.
-n No lookup of destination names.
Use when no DomainNameServer is available.
-F flow label ping6, Allocate and set 20 bit flow label , if zero, random flow label.
-l preload sends preload packets not waiting for reply.
Only the super-user may preload more than 3.
-i interval seconds between sending each packet. default 1.000
Only super-user may use less 0.200 seconds.
-f flood
ECHO_REQUESTs output a dot ,
ECHO_REPLYs output a provides very brief display of how many packets are being dropped.
If interval is not given, packets are sent as fast as they come back or one hundred times per second, whichever is more!
Only the super-user may use this option with zero interval.
-A Adapt interval dynamically to round-trip time,
In an attempt to keep 1 ping present in the network not more than one (or more, if preload )
Minimum 200msec for not super-user.
-b if bind the socket for sending.
-I if Set source address. Argument may be numeric IP address or name of device.
Required for IPv6 link-local address .
-r routing tables are bypassed, packets are send directly to a host on an attached interface.
If the host is not on a directly-attached network, an error is returned.
ping: sendmsg: Network is unreachable
Ping a local host through an interface that has no route through it provided -I is also used.
-L Loopback of multicast packets is supressed if destination is a multicast address.
-p pattern pad bytes to fill out the packet with up to 16 bytes. Useful for diagnosing data-dependent problems.
For example: -p ff will cause the sent packet to be filled with all ones.
-Q tos Quality(Type Of Service) related bits are set per RFC1349
Note that this is a 4 bit field which is NOT nibble aligned.
Values shown are as the appear in a packet dump if the 3 bit PRECENDECE is 0
congestion control01 (ECN must be enabled in the kernel.
minimal $ cost 02
maximize reliability 04
maximize throughput 08
low delay10

Multiple TOS bits should not be set simultaneously.

Precedence range from

priority 0x20
net control 0xE0

root (CAP_NET_ADMIN capability) required to use Critical or higher precedence value.

tos can be either decimal or hex .

RFC2474, these fields has been redefined as
8-bit Differentiated Services (DS), consisting of: bits 0-1 of separate data (ECN will be used, here), and bits 2-7 of Differentiated Services Codepoint (DSCP).

-R Record Route. (IPv4 only)
Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on returned packets. The header is only large enough for 9 routes.
Many hosts ignore or discard this option.
-s packetSize size packet data bytes. default 56, i.e. 64 ICMP data bytes including header.
-S sndbuf socket sndbuf, If not specified buffer not more than one packet.
-t ttl Time to Live.
-T option tsonly (only timestamps),
tsandaddr (timestamps and addresses) or
tsprespec host1 [host2 [host3 [host4]]] (timestamp prespecified hops).
-M £ mask
See hping3

mask: output the netmask of the remote machine. The net.inet.icmp.maskrepl MIB variable to enable .
time: output the origination, reception and transmission timestamps. 2/10/13

sudo /sbin/ping  -M time
PING ( 56 data bytes
20 bytes from icmp_seq=0 ttl=64 tso=20:26:05 tsr=20:26:02 tst=20:26:02
wrong total length 40 instead of 96
20 bytes from icmp_seq=1 ttl=64 tso=20:26:06 tsr=20:26:03 tst=20:26:03
wrong total length 40 instead of 96
-M hint Select Path MTU Discovery strategy
do prohibit fragmentation, even local one
want do PMTU discovery, fragment locally when packet size is large
dont do not set DF flag
-D Set Don't Fragment A
-Cdon't use cellular network interface
-U Display full user-to-user latency
Normally ping prints network round trip time, which can be different f.e. due to DNS failures.
-V Show version and exit.
-w deadline seconds, before ping exits regardless of how many packets have been sent or received.
In this case ping does not stop after count packet are sent, it waits either for deadline expire or until count requests are answered or for some error notification from network.
-W timeout wait for a response seconds. The option affects only timeout in absense of any responses, otherwise ping waits for two RTTs.
-g sweepMin min bytes of payload when sending sweeping pings. Default 0.
‑G sweepMax maximum
-h sweepIncr increment ,default 1.
-b Allow pinging a broadcast address.
-B Bind to source address selected when ping starts.
-d Set the SO_DEBUG option on the socket being used. not used by Linux kernel.

Fault isolation:

  1. ping, the local host, to verify that the network interface is up and IP is running.
  2. ping another host within the same subnet by IPaddress to verify that cabling and switches are working use arp
  3. ping the default gateway by ip address route
  4. ping the local host by name to verify the DomainNameResolution is working
  5. ping hosts and gateways further and further away (meaning more and more hops) or
    Use traceroute
  6. Observe the statics for timings. large StdDev (standard Devation) indicates a problem.
Duplicate packets are not included in the packet loss calculation
The round trip time is used in calculating the minimum/average/maximum round-trip time numbers.
Statistics are output without termination with SIGSTATUS ^t stty -a

Return code

If ping does not receive any reply packets it exits with return code 1.

If a packet count and deadline are both specified, and fewer than count packets are received by the time the deadline has arrived, it will exit with code 1.
On other errors it exits with code 2.
Otherwise it exits with code 0. making it possible to use the exit code to see if a host is alive.
Ping is intended for use in network testing, measurement and management.
It can impose excessive on the network, it is unwise to use ping during normal operations or from automated scripts.

ICMP Packet Details

An IP header without options is 20 bytes long, an ICMP ECHO_REQUEST adds 8 .
Additional packetsize bytes (default 56) are added, for a total default of 84.
An ICMP ECHO_REPLY is 8 bytes more than the ICMP ECHO_REQUEST header.

If packetsize is at least of size of struct timeval, a timestamp is included at the beginning of to compute round trip times.

Duplicate and Damaged Packets

Duplicate packets seem to be caused by inappropriate link-level retransmissions, if they occur at low frequency it may not be cause for alarm.

Damaged packets often indicate broken hardware somewhere in the route. traceroute can aid in diagnosing the route.
Remember that each ping may take a different path to and from the target.

Different Data Patterns

The network should not treat packets differently depending on the data.
Data-dependent problems have been known to appear. Depending on the underlying media, the pattern that will have problems is something that doesn't have sufficient transitions such as all ones or all zeros, or a pattern right at the edge, such as almost all zeros. It isn't necessarily enough to specify a data pattern of all zeros (for example) on the command line because the pattern that is of interest is at the data link level, and the relationship between what you type and what the controllers transmit can be complicated.

A particular file that either can't be sent or that takes much longer to transfer than expected indicates a data dependent problem. Examine this file for repeated patterns that can be tested using -p.

TTL Details

Time to live is the remaining number of times a packet will be transfered from one host or router to another and has nothing to due with time.
Each transfer decrements TTL and if it becomes 0, the packet is not transfered to the next destination.
This prevents packets from looping in the event of a routing definition error.
For example host1 forwards to routerA which forwards to host1.

The maximun is 255, the default varies with the system and may be specifiec in the command.
This may explain why ping reaches a host, but telnet or ftp which (may use 30) cannot.

When the destination system receives a ping, it creates an IMCP ECHO_REPLY with a TTL of:

  1. the value from the REQUEST this case the TTL value in the received packet will be 255 minus the number of routers in the round-trip path.
  2. Set it to 255; . In this case the TTL value in the received packet will be 255 minus the number of routers in the path from the remote system to the pinging host.
  3. Set it to some other value. Some machines use the same value for ICMP packets that they use for IP packets, for example either 30 or 60.
To determine what each endpoint starts with and replies to, first ping each host from itself.

> ping
PING ( 56(84) bytes of data.64 bytes from ( icmp_seq=1 ttl=244 time=83.2 ms
64 bytes from ( icmp_seq=2 ttl=244 time=101 ms
64 bytes from ( icmp_seq=3 ttl=244 time=166 ms
64 bytes from ( icmp_seq=4 ttl=244 time=87.3 ms--- ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 83.258/109.508/166.406/33.506 ms
In the example the value of 244 indicates that there were 11 transfers FROM destination to the originating host.
This can be confirmed with traceroute.
/sbin/ping -c 3    # DGG's router then to DaPie
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=58 time=27.215 ms
92 bytes from dd-wrt ( Redirect Host(New addr:
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 d57f   0 0000  3f  01 74b5 

64 bytes from icmp_seq=1 ttl=58 time=19.714 ms
64 bytes from icmp_seq=2 ttl=58 time=23.979 ms 
--- ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 19.714/23.636/27.215/3.072 ms

Ocassionally a type 3 packet (Dest Net Unreachable) is received from the first hop after the router!Mac OS
ALthough the
76 bytes from ( Destination Net Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 5400 bd2f   0 0000  3e  01 3a06 
Version:4;HeaderLength:5;Len:54(NOT 5400!); Protocol ICMP01

Additional Notes

Success does not mean that all routing table information, interfaces, cables or name resolutions are totaly functional, but at least they work for the tested case.

Datagrams have IP and ICMP headers, a struct timeval and pad bytes.
Implementation of ICMP protocol's ECHO_REQUEST/ECHO_RESPONSE is mandatory for an IP installation to be conformant.

Due to abuses some hosts, especially residential routers, may be configured to ignore the request.

There are various versions of ping available


ping requires CAP_NET_RAWIO capability to be executed. It may be used as set-uid root.


ICMP error messages include ICMP message types 3 (Destination Unreachable), 4 (Source Quench), 5 (Redirect), 11 (Time Exceeded), and 12 (Parameter Problem).
 92 bytes from hotspot.hotspot ( Destination Port Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 7115   0 0000  3f  01 3db7 
Other ICMP request messages include ICMP message types 10 (Router Solicitation), 13 (Timestamp)
ICMP reply messages include ICMP message types 0 (Echo Reply), 9 (Router Advertisement), 14 (Timestamp Reply),
;; reply from unexpected source:, expected
 ;; Got bad packet: extra input data 79 bytes 
    42 80 85 80 00 01 00 01 00 00 00 00 02 31 30 01 B............10. 
    31 03 31 36 38 03 31 39 32 07 69 6e 2d 61 64 64 
    72 04 61 72 70 61 00 00 0c 00 01 c0 0c 00 0c 00 
    01 00 00 00 00 00 18 00 11 6d 79 6e 65 74 77 6f .........mynetwo 
    72 6b 73 65 74 74 69 6e 67 73 03 63 6f 6d 00  


nc, netstat(1), ifconfig(8), Hping

linux differenes

-A £ Adaptive ping. Interpacket interval adapts to round-trip time, so not more than one (or more, if preload is set) unanswered probe is present in the network.
Minimal interval is 200msec for non super-user.
-M pmtudisc_opt Select Path MTU Discovery strategy. be either do (prohibit fragmentation, even local one), want (do PMTU discovery, fragment locally when packet size is large), or dont (do not set DF flag).

Return Codes

13 Midphase returns unlucky if caged !

1 /usr/sbin/proxyexec -c cagefs.sock $uname b1g928Lh0TeiN4rf $HOME PING 304812 $hostname
You are not authorized to run this command. + RETVAL=1.