6

Is it possible for ping command in Linux(CentOS) to send 0 bytes. In windows one can define using -l argument
command tried

  ping localhost -s 0
    PING localhost (127.0.0.1) 0(28) bytes of data.
    8 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64
    8 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64
    ^C
    --- localhost ping statistics ---
    2 packets transmitted, 2 received, 0% packet loss, time 999ms



man ping

-s packetsize
              Specifies  the  number of data bytes to be sent.  The default is
              56, which translates into 64 ICMP data bytes when combined  with
              the 8 bytes of ICMP header data.

Edit1: adding windows output of ping just in case some one needs it

ping 127.0.0.1  -l 0

Pinging 127.0.0.1 with 0 bytes of data:
Reply from 127.0.0.1: bytes=0 time<1ms TTL=128
Reply from 127.0.0.1: bytes=0 time<1ms TTL=128
Reply from 127.0.0.1: bytes=0 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

ping 127.0.0.1

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
  • 2
    Out of personal curiosity, why are you wanting to do this? – Bratchley Oct 8 '15 at 18:32
  • 7
    If you can capture one of these alleged 0-byte ping packets from the windows host I'll be happy to dissect it and add it to my answer below to show you that it really isn't 0 bytes. – casey Oct 8 '15 at 18:50
  • @Bratchley i have many remote routers which i am trying to monitor from Linux box. Basically the network person always uses ping <ip> -l 0 to check connection of remote availability from windows, so question comes to me why can't you send 0 bytes data. – vnc Oct 9 '15 at 4:28
  • @casey thanks for your answer i have some knowledge that whenever we ping it sends some data(IP header + packets size defined) will check with wireshark/tcpdump – vnc Oct 9 '15 at 4:35
26

A ping cannot be 0 bytes on Linux, Windows or any other platform that claims to be able to send pings. At the very least the packet must contain an IP header and a non-malformed no-trick-playing ping will also include an ICMP header, which is 8 bytes long.

It is possible that windows differs in how they output the bytes received. Linux tells you the size of the ICMP portion of the packet (8 bytes for the ICMP header plus any ICMP data present). Windows may instead print the number of ICMP payload data bytes so that while it tells you "0", those 8 ICMP header bytes are still there. To truly have 0 ICMP bytes that means your packet is a raw IP header and no longer an ICMP ping request. The point is, even if windows is telling you the ping packet is 0 bytes long, it isn't.

The minimum size of an ICMP echo request or echo reply packet is 28 bytes:

  • 20 byte IP header,
  • 4 byte ICMP header,
  • 4 byte echo request/reply header data,
  • 0 bytes of ICMP payload data.

When ping on linux prints:

8 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64

Those 8 bytes are the 4 byte ICMP header and the 4 byte ICMP echo reply header data and reflect an ICMP payload data size of 0 bytes.

  • 1
    Excellent answer. I've done a separate answer assuming its ethernet, with a mTU of 64 bytes :) – Criggie Oct 8 '15 at 20:37
11

What's your layer 2 transmission medium? Ethernet? There's no way to have an ethernet frame shorter than 64 bytes, regardless of what it carries.

So, even if you could send a ICMP ping with 0 bytes of payload, your ethernet card will pad the frame up to 64 bytes for transmission.

@Casey showed that your theoretical minimum is 28 bytes, but ethernet will add 36 bytes of padding to bring it to 64 bytes total. Any less is a Runt packet and is too short.

Why 64 bytes? That's a whole new question and has to do with the transmission time of a bit and collision detection and that ethernet is a CSMA/CD domain not CSMA/CA.

4

You have to distinguish between header size and payload size (data). ICMP packets can optionally hold data. The header has a constant size of 64 bit, that is 8 bytes. The payload can vary and may even be absent. This is meant with sending 0 bytes and exactly descriped in the man-page of ping:

  -s packetsize
          Specifies the number of data bytes to be sent.  The default is 56, which translates into 64 ICMP data bytes when combined with the 8 bytes of ICMP header data.

When you execute by setting packet size to 0, it outputs the following:

ping -s 0 192.168.172.51
PING 192.168.172.51 (192.168.172.51) 0(28) bytes of data.
8 bytes from 192.168.172.51: icmp_seq=1 ttl=63
8 bytes from 192.168.172.51: icmp_seq=2 ttl=63

As you can see, it really mentions 8 bytes - counting header plus payload. You can make further tests with arbitrary packet sizes and see that there will always be 8 bytes more transmitted, because this is the constant size of the additional header.

A simultaneous tcpdump justifies this:

11:49:30.271160 IP 192.168.172.50 > 192.168.172.51: ICMP echo request, id 5472, seq 30, length 8

The 28 extra bytes in the header line, 0(28), come from IP+ICMP header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.