Is there an ICMP echo request service?

Question

Often, in applications that I develop, I like to include a network status indicator for various devices on the network. The easiest way to monitor these devices is by pinging them. But ICMP echoes are often difficult to integrate into an application due to security requirements with raw sockets, or performance issues with shelling out to ping. Also, for situations where this isn't a problem, I'm kind of over writing slightly different variations of the same ping code for various situations.

Most of the devices that I monitor are embedded devices with minimal network capabilities (but always include ICMP echo), so I do have to stick with this protocol, things like Echo Protocol (pointed out by Mark in comments below, thanks!) usually aren't available to me.

Is there a service that already exists that can provide low-overhead ICMP ping services to a non-root application?

I am considering writing a service that runs as root and allows other non-root applications to connect to it, add devices to monitor, and then query ping times and network status from it, but I don't want to reinvent a wheel and I'm wondering if something like this exists already.

Answer 1

The answer to your question is probably "No, there is not."

The reason for this is that ICMP is a low level protocol, and in order to produce ICMP traffic, an application needs privileged access to your network interface. You can see evidence this on most systems by the fact that the binaries that generate ICMP are set-uid root. Note the sticky bit:

$ ls -l /sbin/ping /usr/sbin/traceroute
-r-sr-xr-x  1 root  wheel  28088 Aug 12 12:19 /sbin/ping
-r-sr-xr-x  1 root  wheel  28608 Aug 12 12:20 /usr/sbin/traceroute

(This is on FreeBSD. Your results on other operating systems may be different.)

For an application to generate raw network traffic, it needs to run as root. Since /sbin/ping already runs as root, your best bet is likely to use it to generate your pings.

If you're doing this for a large number of hosts, you might want to look at fping. Another option would be tcping, which can generate TCP packets that provide similar results to an ICMP ping. The requirement would be an open port on the target system to receive the packet. You might be able to use this or replicate its approach based on the source. Both of these may already be available as a package for your operating system.

For a larger scale monitoring solution, Nagios and Zabbix are popular free options, but there are many others.

Answer 2

Maybe too bloated for what you are looking for, but most full-fledged monitoring solutions such as Nagios, icinga or check_mk provide icmp monitoring and often provide APIs that you can query.

Answer 3

While ICMP echo is nice in that it is a positive reply, you can do machine alive tests with negative replies, like port unreachable and protocol unreachable, provided your remote machine provides them. Try:

• connect()ing to an unused TCP port
• send()ing to an unused UDP port

You should be able to do a setsockopt(fd, IP_RECVERR, ...) in order to get the errors back cleanly, and a special option to receive the errors themselves. (On linux, see man page ip(7).)

Answer 4

As an updated answer to this older question, since 2019 it has been possible to create a user-level application on a Linux-based platform that can perform ping requests without needing root privileges.

ls -l /bin/ping
-rwxr-xr-x 1 root root 55720 Mar  8  2021 /bin/ping

ping -c1 google.co.uk
PING google.co.uk(lhr48s27-in-x03.1e100.net (2a00:1450:4009:815::2003)) 56 data bytes
64 bytes from lhr35s11-in-x03.1e100.net (2a00:1450:4009:815::2003): icmp_seq=1 ttl=119 time=13.0 ms

--- google.co.uk ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 13.047/13.047/13.047/0.000 ms

How does ping work on Fedora without setuid and capabilities?

The Linux kernel's net.ipv4.ping_group_range sysctl parameter defines a numerical range of user groups that are permitted to send and receive ping packets without additional permissions or capabilities.