More of this Feature Part 2: Advanced Ping Topics Related Resources Ping Tool Directory IP Tutorials From Other Guides Hacker Tools Elsewhere on the Web RFC 792 - ICMP The Ping of Death

Ping Basics

Operating systems like Microsoft Windows, Linux/UNIX, and NetWare supply a text-mode ping utility. These shell commands require only a single argument that specifies the host name or IP address of the target computer.

Taking Windows/DOS as an example, the following illustrates the results of pinging a responsive Web server.

C:\> ping www.google.com

Pinging google.com [64.208.34.100] with 32 bytes of data:

Reply from 64.208.34.100: bytes=32 time=210ms TTL=49
Reply from 64.208.34.100: bytes=32 time=211ms TTL=49
Reply from 64.208.34.100: bytes=32 time=200ms TTL=49
Reply from 64.208.34.100: bytes=32 time=201ms TTL=49

Ping statistics for 64.208.34.100:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 200ms, Maximum =  211ms, Average =  205ms

As shown, the default configuration of Windows ping sends four, 32-byte packets to the destination. Both of these parameters can be overridden on the command line, and in Windows the -t option causes packets to be sent indefinitely (until terminated by the user). On a few other systems, including Red Hat Linux, indefinite pings are the default.

Ping reports the percentage of packets acknowledged by the remote host. Typically this number will be 100% (as in the example above) or 0%. When an Internet host pings at 0%, this does not necessarily mean the server is "down" or unavailable. Internet Web servers especially may be configured to disregard ping requests for security purposes. The output of Windows ping in these cases looks like the following:

C:\> ping www.cnn.com

Pinging cnn.com [207.25.71.26] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 207.25.71.26:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum =  0ms, Average =  0ms

On intranets and other private LANs, ping can be an especially useful network diagnostic tool. One scenario that will result in a ping response rate of other than 0% or 100% occurs when a host is shutdown and leaves the network (or boots and joins the network) as shown below:

C:\> ping boswell

Pinging boswell [192.168.0.1] with 32 bytes of data:

Reply from 192.168.0.1: bytes=32 time=<10ms TTL=128
Reply from 192.168.0.1: bytes=32 time=<10ms TTL=128
Request timed out.
Request timed out.

Ping statistics for 192.168.0.1:
    Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
...

It is also possible for ping packets to be lost in transit, causing ping to report a host as unavailable when in fact it is available but unreachable. One cause of lost or dropped packets is extreme levels of traffic; in general, ping utilities will be unusable on heavily-loaded networks. Another cause of lost packets -- the "too many hops" or zero-TTL condition -- will be described later.