4

I was learning server/client basics, as part of my networking programming skills development.

So basically I write server listening on some port, and client connecting to it and data flow goes on...

Now I'm fascinated how ping is able to receive response from remote machine, without any service responding to it? Or I'm mistaking here?

1
  • See my updated answer for how ping can access the received ICMP messages
    – wnrph
    Oct 11, 2012 at 20:13

3 Answers 3

10

As ping (more accurately, ICMP echo requests) is part of the Internet Protocol, your network stack (which is your operating system's implementation of the protocol) answers these requests.

It's neither TCP nor UDP nor any other transport protocol. In the internet header, there is a protocol field which indicates what type of payload the IP packet contains. For TCP packets that field indicates TCP. For ping packets it indicates ICMP.

Btw. this is not the only use of ICMP. E.g. when the TTL of a packet drops to zero while traveling across the net, it is discarded and the sender is notified by an ICMP packet.

If you wonder how ping (8) manages to display received ICMP replies from user space, it does so using the socket API. This is the relevant section from the source code:

/* Initialize raw ICMP socket */
proto = getprotobyname ("icmp");
if (!proto)
  {
    fprintf (stderr, "ping: unknown protocol icmp.\n");
    return NULL;
  }

fd = socket (AF_INET, SOCK_RAW, proto->p_proto);
0
5

Yes, you're slightly mistaken.

When a ping request is sent to a host, by standard (RFC 1122), a host must reply. Thus, there is a "service" responding to it. It's not an application level service - the TCP/IP stack itself is the "service" responding.

Ping is sessionless - which is what might be confusing you. Ping uses IP which does not require a session to be established through negotiation (which TCP does). When you wrote your program for your class, I'd bet you wrote it using TCP sockets.

5
  • It gets funny when the iptables stateless rules documentation talks about ping "connections" :-) when it is really connection less.
    – wnrph
    Oct 11, 2012 at 14:51
  • 3
    UDP? Wrong. It uses ICMP on top of IP.
    – wnrph
    Oct 11, 2012 at 14:52
  • @artistoex, You're right. I'll edit. I have UDP on the brain - doing something with it. :)
    – John
    Oct 11, 2012 at 14:53
  • @artistoex, About iptables, I think it's harder for people to envision "connection less" connections. It's just easier to use generically refer to a common term e.g. "bandwidth" vs "speed". etc.
    – John
    Oct 11, 2012 at 14:57
  • Sorry, I've meant to say iptables stateful rules
    – wnrph
    Oct 11, 2012 at 15:12
2

ping actually make an ICMP request against the IP stack itself, so no services on the machine will record it, but if you have something like wireshark running, you can detect the packets that way.

3
  • Against the NIC? That's wrong.
    – wnrph
    Oct 11, 2012 at 14:49
  • Corrected. Apologies, still early here.... Oct 11, 2012 at 14:51
  • Corrected, it's just the IP stack, there's no TCP involved (ICMP takes its place) Oct 11, 2012 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .