How Does the Ping Command Work? A Deep Dive into ICMP Mechanics

The ping command is used to test reachability between a local host and a remote host; it sends ICMP echo request packets and waits for echo replies, indicating network connectivity.

Ping Workflow

On host A (e.g., 192.168.0.1) the user runs ping 192.168.0.2 to check host B.

Ping builds an ICMP echo‑request packet, which the IP layer wraps into an IP packet.

The IP layer adds source and destination IP addresses and other control fields, forming the IP packet.

ARP resolves the destination MAC address; the packet is then encapsulated in an Ethernet frame and transmitted.

Host B receives the frame, extracts the IP packet, passes the ICMP payload to the ICMP module, which generates an echo‑reply packet.

Host A receives the reply; if it arrives within the timeout, the hosts are reachable, and the round‑trip time can be measured.

ICMP Overview

ICMP (Internet Control Message Protocol) operates on top of IP. It carries control messages such as echo requests/replies, destination‑unreachable, time‑exceeded, and redirect messages. ICMP packets are encapsulated inside IP packets.

ICMP messages consist of an 8‑bit type field, an 8‑bit code field, a 16‑bit checksum, and optional data. They are divided into two categories:

Query messages : used for operations like ping, subnet mask queries, and timestamp requests.

Error messages : generated when IP transmission encounters problems (e.g., host unreachable, network unreachable, time exceeded, parameter problems, redirects).

Traceroute and ICMP Errors

Traceroute exploits ICMP error messages to map the route to a destination. It sends UDP packets with incrementally increasing TTL values. When a router decrements TTL to zero, it discards the packet and returns an ICMP "time exceeded" error, revealing the router’s address. By also sending packets to an unreachable port, traceroute triggers "port unreachable" ICMP errors from the final host.

This technique demonstrates that ICMP is not only for successful echo checks but also for diagnosing network failures.

Original content was published on the WeChat public account "不止思考".