0

ping - send ICMP ECHO_REQUEST to network hosts

when I run ping host in terminal, is ping a ICMP client?

Does ping connect to a ICMP server running on host? What is the program which is the ICMP server?

Does ping connect to a port on host, and is that port number the one for the ICMP server?

1

PING is indeed a client.

The ping command also uses a part of the ICMP protocol, namely echo-reply (ICMP type 0 message) and echo-request (ICMP message type 8).

Many professionals and network monitoring software use echo-request/reply successful ICMP messages processing as an indicator a system is up/down. However this is a convention, and not strictly mandatory. For instance, I can define in Nagios that I will monitor my Linux servers with the SSH TCP/22 port instead of using PINGs.

The concept as an established connection does not exist per se as in TCP connections. ICMP is a not a connection oriented protocol.

As stated earlier, the concept of port also does not exist - the Linux kernel processes an ICMP packet, and throws an answer to it accordingly, forgetting then about the deed (ignoring other mechanisms as rate limiting, for instance).

Ping is also available to user with special privileges, or has to be a setuid binary, as it uses RAW sockets to manufacture a ICMP packet.

You can also define if the kernels answer or not to an ICMP echo-request message with a sysctl/proc setting.

To disable answer to ICMP pings do:

echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all    

Or to enable it again:

echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

As for the part of the kernel responsible for handling ICMP messages, it is found in icmp.c in the Linux kernel sources as in https://github.com/torvalds/linux/blob/master/net/ipv4/icmp.c

As for the ICMP packet see this image: icmp

As for more kernel definitions:

linux/icmp.h

#define ICMP_ECHOREPLY      0   /* Echo Reply           */
#define ICMP_ECHO           8   /* Echo Request         */
  • Thanks. (1) Does ping test some kind of connection? Not the same kind of connection tested by telnet? (2) is the ICMP server the OS kernel? – Tim Aug 21 '18 at 23:31
  • Many professionals and network monitoring software use echo-request/reply as an indicator a system is up/down. Telnet tests TCP ports and not ICMP services, and it can tests most TCP services, and definitively is not the same thing. Yes, it is the kernel, edited the answer for clarity. – Rui F Ribeiro Aug 21 '18 at 23:33
  • 1
    I recommend to never use ping to test if a server is running or not, because by using ICMP it will give completely different results than by TCP or UDP, and will be wrongly analyzed. Instead do the logical: if you want to test if an SSH server is up, do a TCP/22 connection, if you want to test a webserver is up, do a TCP/80 or 443 connection etc... In short really test the service you want to test, not something besides it completely unrelated. – Patrick Mevzek Aug 24 '18 at 3:59
  • @PatrickMevzek I do agree here completely, and that what I am saying in a relate thread of Tim wrote a couple of minutes apart, hence writing many professionals. In my Nagios old Nagios the Linux template tested port 22/TCP instead of pinging. – Rui F Ribeiro Aug 24 '18 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.