Take the 2-minute tour ×

I was learning server/client basics, as part of my networking programming skills development.

So basically I write server listening on some port, and client connecting to it and data flow goes on...

Now I'm fascinated how ping is able to receive response from remote machine, without any service responding to it? Or I'm mistaking here?

share|improve this question
See my updated answer for how ping can access the received ICMP messages –  artistoex Oct 11 '12 at 20:13

3 Answers 3

As ping (more accurately, ICMP echo requests) is part of the Internet Protocol, your network stack (which is your operating system's implementation of the protocol) answers these requests.

It's neither TCP nor UDP nor any other transport protocol. In the internet header, there is a protocol field which indicates what type of payload the IP packet contains. For TCP packets that field indicates TCP. For ping packets it indicates ICMP.

Btw. this is not the only use of ICMP. E.g. when the TTL of a packet drops to zero while traveling across the net, it is discarded and the sender is notified by an ICMP packet.

If you wonder how ping (8) manages to display received ICMP replies from user space, it does so using the socket API. This is the relevant section from the source code:

/* Initialize raw ICMP socket */
proto = getprotobyname ("icmp");
if (!proto)
    return NULL;

share|improve this answer
thanks, that's what I suspected too... –  JalilKarimov Oct 11 '12 at 14:50

Yes, you're slightly mistaken.

When a ping request is sent to a host, by standard (RFC 1122), a host must reply. Thus, there is a "service" responding to it. It's not an application level service - the TCP/IP stack itself is the "service" responding.

Ping is sessionless - which is what might be confusing you. Ping uses IP which does not require a session to be established through negotiation (which TCP does). When you wrote your program for your class, I'd bet you wrote it using TCP sockets.

share|improve this answer
It gets funny when the iptables stateless rules documentation talks about ping "connections" :-) when it is really connection less. –  artistoex Oct 11 '12 at 14:51
UDP? Wrong. It uses ICMP on top of IP. –  artistoex Oct 11 '12 at 14:52
@artistoex, You're right. I'll edit. I have UDP on the brain - doing something with it. :) –  John Oct 11 '12 at 14:53
@artistoex, About iptables, I think it's harder for people to envision "connection less" connections. It's just easier to use generically refer to a common term e.g. "bandwidth" vs "speed". etc. –  John Oct 11 '12 at 14:57
Sorry, I've meant to say iptables stateful rules –  artistoex Oct 11 '12 at 15:12

ping actually make an ICMP request against the IP stack itself, so no services on the machine will record it, but if you have something like wireshark running, you can detect the packets that way.

share|improve this answer
Against the NIC? That's wrong. –  artistoex Oct 11 '12 at 14:49
Corrected. Apologies, still early here.... –  Jared Tritsch Oct 11 '12 at 14:51
Corrected, it's just the IP stack, there's no TCP involved (ICMP takes its place) –  Darth Android Oct 11 '12 at 14:57

Your Answer


