I was learning about the ping command.

In that I am not able to understand the output of ping command with -T tsonly and tsandaddr.

The output is,

$ ping -T tsonly
PING ( 56(124) bytes of data.
64 bytes from icmp_req=1 ttl=63 time=0.470 ms

 TS:    43448298 absolute
$ ping -T tsandaddr
PING ( 56(124) bytes of data.
64 bytes from icmp_req=1 ttl=63 time=0.434 ms

TS:    43461227 absolute    0    32    0

I was searched in google. But I didn't get the answer. In man page also I didn't get the answer.

Can anyone please explain the output of these two command. What time these two ping command prints?


From the ping man

-T timestamp option

Set special IP timestamp options. timestamp option may be either tsonly (only timestamps), tsandaddr (timestamps and addresses) or tsprespec host1 [host2 [host3 [host4]]] (timestamp prespecified hops)

The IP timestamp option is an IP packet option field used to record timestamps (in Universal Time) of every device that handles the datagram (and that support this option). RFC781

  • The -T tsonly requests and shows only timestamps recorded in the IP timestamps field, the first is absolute and the next ones seems to be delta:

(from the RFC: flag = 0 -- time stamps only)

  • The -T tsandaddr requests and shows timestamps next to the IP address of the devices:

(from the RFC: flag = 1 -- each timestamp is preceded with internet ID of the registering entity)

  • The -T tsprespec requests and show timestamps only for the internet IP address specified:

(from the RFC: flag = 3 -- the internet ID fields are prespecified. An IP module only registers its timestamp if it matches its own ID with the next specified internet ID)

  • Which time it prints in the result ? For example, it is milliseconds or microseconds.
    – user152030
    May 3 '16 at 3:48
  • I was understand the first time. But I didn't understand the remaining times. What is the meaning of delta time?
    – user152030
    May 3 '16 at 5:20

As I can understand -T option adds TimeStamp option to an IP packet. Here is rfc https://www.rfc-editor.org/rfc/rfc781. TS: absolute is is the number of milliseconds since midnight

but I can understand about next digits. I think this is the difference between your host and other hops. But not all routers will accept this type of packets

if you will ping yourself, like you will see the zeroes

  • not only zero, I got negative values also. Is negative values are allowed in timestamp?
    – user152030
    May 3 '16 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy