Why Can You Ping 127.0.0.1 Even When the Network Is Down?

You may wonder why you can ping 127.0.0.1 even when the network cable is unplugged; the answer lies in the loopback address and the kernel's handling of local traffic.

What is 127.0.0.1

127.0.0.1 is an IPv4 address. IPv4 uses 32 bits (4 bytes). Any address that starts with 127 belongs to the loopback range, a special range defined by convention. 127.0.0.1 is just one of many loopback addresses.

#define INADDR_LOOPBACK 0x7f000001 /* 127.0.0.1 */

IPv4 provides about 4.3 billion addresses, which is insufficient for the world’s population, leading to the development of IPv6 with 128‑bit addresses (≈10³⁸ possible addresses).

What is ping

Ping is an application‑layer utility that sends a small ICMP echo‑request packet to a target host and waits for an echo‑reply, allowing you to test reachability.

It uses the ICMP protocol at the network layer, which itself is carried over IP.

Difference between TCP data transfer and ping

Both use sockets, but ping creates a raw socket ( socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) that operates at the network layer, while TCP uses a stream socket ( socket(AF_INET, SOCK_STREAM, 0)) at the transport layer.

Why ping works when the network is down

When the destination is a loopback address, the kernel routes the packet to the local “fake” network interface (lo0) instead of a physical NIC. The packet is placed into an internal queue ( input_pkt_queue) and processed by the kernel thread ksoftirqd, never leaving the host.

Loopback vs. local IP address

Both ping 127.0.0.1 and ping of the machine’s own IP (e.g., 192.168.31.6) use the lo0 interface, so there is no difference in the network path.

127.0.0.1, localhost and 0.0.0.0

localhost

is a hostname that resolves to 127.0.0.1 via /etc/hosts. The address 0.0.0.0 is not a valid destination for ping; it represents “any IPv4 address” and is used by servers when listening on all interfaces.

$ ping 0.0.0.0
PING 0.0.0.0 (0.0.0.0): 56 data bytes
ping: sendto: No route to host

#define INADDR_ANY ((unsigned long int) 0x00000000) /* 0.0.0.0 */

Summary

127.0.0.1 is a loopback IPv4 address; localhost is a hostname that resolves to it.

Pinging the loopback address or the machine’s own IP uses the lo0 “fake” NIC and never leaves the host, so it works even when the network cable is unplugged.

Servers listening on 0.0.0.0 accept connections on all local IPv4 addresses, while clients must specify a concrete address.