How ping & ICMP work
Ping is the first tool everyone reaches for, but what is it actually measuring? Here’s ICMP, round-trip time, TTL, and how to read the output.
ICMP, the network’s status channel
ICMP, the Internet Control Message Protocol, is how hosts and routers report network conditions, unreachable destinations, expired packets, and diagnostics. It rides directly on IP, alongside TCP and UDP, but unlike them it carries no application data. Ping is just the most famous use of ICMP: a reachability and latency probe.
Echo request, echo reply
When you ping a host, your machine sends an ICMP echo request. If the host is up,
reachable, and willing to answer, it returns an ICMP echo reply with the same payload. Ping
measures the round-trip time (RTT): how long that there-and-back took, and tracks how many
replies came back versus how many requests went out (packet loss).
Reading the output
- time=: the round-trip time in milliseconds. Lower is better; the number is dominated by physical distance and congestion.
- TTL (Time To Live): a counter decremented by each router (hop) the packet crosses. It exists to kill packets stuck in routing loops. The value you see hints at how many hops away the host is and which OS it likely runs (common starting values are 64, 128, 255).
- packet loss: replies missing. Steady loss means a real problem; occasional loss can be normal deprioritization of ICMP.
What ping can’t tell you
A successful ping proves IP reachability and gives you latency, nothing more. Plenty of hosts
deliberately drop ICMP, so “no reply” does not mean “down”; the service
you actually care about may be running fine on its TCP port. And a fast ping says nothing about whether an
application is healthy, only that packets reach the machine. For path-level detail, traceroute
(which uses TTL deliberately) shows each hop; for service health, test the actual port.
FAQ
Why does a host not respond to ping but the website works?
Many firewalls drop ICMP while allowing TCP on ports 80/443. The site is up; ICMP is just filtered. Test the port, not ping.
What does the TTL value tell me?
It started at a round number (often 64, 128, or 255) and was decremented once per router. The gap from that start estimates the hop count; the start value hints at the remote OS.
Is high ping the same as low bandwidth?
No. Ping measures latency (delay), not throughput (bandwidth). A link can be high-bandwidth and high-latency at once.
Related
Probing TCP ports instead is port scanning; the web’s request layer is HTTP.