After executing the following to disable ping replies:

# sysctl net.ipv4.icmp_echo_ignore_all=1
# sysctl -p

I obtain different results from pinging localhost vs.

# ping -c 3 localhost
PING localhost(localhost (::1)) 56 data bytes
64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.029 ms
64 bytes from localhost (::1): icmp_seq=2 ttl=64 time=0.035 ms
64 bytes from localhost (::1): icmp_seq=3 ttl=64 time=0.101 ms

--- localhost ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2042ms
rtt min/avg/max/mdev = 0.047/0.072/0.101/0.022 ms

Pinging fails:

ping -c 3
PING ( 56(84) bytes of data.

--- ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2032ms

Why are these results different?


3 Answers 3


The ping command shows the address it resolved the name to. In this case it resolved to the IPv6 localhost address, ::1. On the other hand, is an IPv4 address, so it explicitly makes ping use IPv4.

The sysctl you used only affects IPv4 pings, so you get replies for ::1, but not for

The address you get from resolving localhost depends on how your DNS is resolver is set up. localhost is probably set in /etc/hosts, but in theory you could get it from an actual name server.

As for how to drop IPv6 pings, you may need to look into ip6tables, as there doesn't seem to be a similar sysctl for IPv6. Or just disable IPv6 entirely, if you're not using it in your network. (Though of course that's not a very forward-looking idea, but doable if you're not currently using it anyway.)

  • 2
    IPv6 requires ICMP to not be blocked in order properly to function. ;)
    – zaTricky
    Commented Mar 16, 2018 at 6:17
  • 3
    @zaTricky, the question only mentioned blocking ping. While obnoxious and not very useful, I don't think it should break anything in general. Blocking all ICMP packets would obviously be much worse, but no-one even suggested that, it was only mentioned in the two comments here...
    – ilkkachu
    Commented Mar 16, 2018 at 12:40
  • Granted, could be more specific. "ICMP echo-request", commonly referred to as ping, is required for proper communication over IPv6. You can block spontaneous unwanted ping ingresses to clients - but if you block outbound you're probably breaking IPv6 functionality. Doesn't help that the question seems to have changed since answers were posted.
    – zaTricky
    Commented Mar 20, 2018 at 8:21
34 is the default loopback of most system. A loopback address is an address used by the system to validate the network stack of the OS.
The loopback address for IPv4 could take any value in the subnet
The loopback address for IPv6 could take any value in the subnet ::1/128
ping any value in those range should work if your network stack is working on your OS.

localhost is a hostname, this a sort of domain name but local to your own machine.
This hostname by default point to your IPv4 and IPv6 loopback which is often or ::1.

localhost address could be changed easily by editing the file /etc/hosts.
If your system use the service systemd-resolved, this service will handle the way localhost is resolved.
According to the documentation of systemd-resolved:

The hostnames "localhost" and "localhost.localdomain" (as well as any hostname ending in ".localhost" or ".localhost.localdomain") are resolved to the IP addresses and ::1

When you try to ping a hostname or domain name it will ask the OS to resolve this hostname or domain name. In your case, you disabled icmpv4 but localhost is resolved as your IPv6 loopback and your IPv4 loopback but only your IPv6 loopback answer.
The difference is in one case you're trying to ping an IP and in the other case you ping a hostname that could take several values.

Disable icmpv6
If you don't need IPv6 I advise you to disable it. It will double all the work you would need to do on firewall and configuring services:

sysctl -w net.ipv6.conf.all.disable_ipv6=0

If you still want IPv6 support and want to avoid icmpv6, you could use ip6tables:

ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
  • 2
    Something is wrong with your hosts file. It should also have ::1 localhost in it. Commented Mar 14, 2018 at 17:04
  • 2
    Side note: remember than in IPv4 the whole network are loopback addresses (so ping will work as well).
    – jjmontes
    Commented Mar 14, 2018 at 17:59
  • 1
    Entries for localhost are not necessarily needed in /etc/hosts. For example, systemd-resolved synthesizes DNS resource records for localhost and localhost.localdomain. Commented Mar 14, 2018 at 19:18
  • @MichaelHampton It's not the complete hosts file but I don't have ::1 localhost running ubuntu 17.10
    – Kiwy
    Commented Mar 15, 2018 at 8:37
  • 2
    The "subnet" ::1/128 corresponds to only one IP, much like only resolves to that one IP.
    – zaTricky
    Commented Mar 16, 2018 at 6:20

Localhost has two addresses, an IPv6 address ::1 and an IPv4 address

IPv6 is the default protocol, so ::1 is always preferred over This is why you have pinged ::1 when asking to ping localhost.

As for why you could ping ::1 but could not ping, your sysctl has only disabled pings for IPv4, but not for IPv6. As far as I can tell, there is no corresponding sysctl to disable pings for IPv6, but you can disable it in the firewall instead if you really need to (of course disabling it is not recommended anyway).

  • 5
    Disabling pings for IPv6 is ill advised at it break connectivity, people connecting from teredo address can no longer reach the machine (as it uses the ping to select the closest anycast teredo tunnel machine)
    – Ferrybig
    Commented Mar 14, 2018 at 17:19
  • 1
    The preference of name resolution for IPv6 vs. IPv4 can be controlled with the /etc/gai.conf file. By default, it has only comments. If you uncomment the precedence lines in it and make the change also suggested in the comments, you can get the hostname resolution to prefer IPv4 instead of the default IPv6.
    – telcoM
    Commented Mar 15, 2018 at 13:31
  • @telcoM Yes, you can do that. If you do, though, it's a good idea to give prominent warnings for anyone who might use that machine, as changing the precedence introduces unexpected behavior. Commented Mar 15, 2018 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .