In order to verify a computer’s availability, ping sends in its default setting four ICMP echo request packets of 32 bytes each to the address assigned as a parameter.
ICMP (Internet Control Message Protocol) is a protocol that enables the exchange of information and error notifications within IPv4 networks. For computer networks using IPv6, ICMPv6 has a successor protocol that can be used for this purpose.
In theory and in accordance with the protocol specification, computers that support ICMP and/or ICMPv6 must automatically respond to incoming echo requests with an ICMP echo reply. In practice, this doesn’t always work, as many administrators, for security reasons, configure the computers they manage in such a way that ICMP packets are rejected without a response. As a result, the unavailability of the target computer cannot be inferred from an unanswered ICMP request.
If the addressed target computer doesn’t respond, ICMP provides a notification from the appropriate gateway. Normally in this case a router responds that either the network or the appropriate host is not available.
If there is no response from the router, it can be assumed that the computer is in fact available but is not automatically responding to the echo request due to its configuration.
The ping command delivers the following information as output:
- Response time in milliseconds (ms)
- Validity period for ICMP packets (time to live, TTL) (only with IPv4)
The response time specifies how long a data packet requires to be sent to the target computer and back. The validity period specified as the TTL corresponds to a data packet’s elapsed time. The initial value amounts to a maximum of 255. Usually, implementations have an initial TTL of either 31, 63 or 127. The TTL is reduced by 1 by every network node that the data packet passes. This is referred to as hops. Should the TTL drop to 0, the data packet is rejected.
The TTL that you receive as output normally corresponds to the responding computer’s initial value minus the number of hops on the route.
With a TTL of 58, for example, you can assume that the response packet was dispatched with an initial value of 63 and passed five network nodes on the way back.