-1

I know that the ping command is used to check if any remote machine is accessible from my machine.

But I do not know how it determines that. My wild guess is that it sends some sample data to port 80 of the remote machine and if it gets delivered it says it's reachable/accessible.

Please correct me if I have mistaken it.

4

2 Answers 2

3

You should read about the ISO/OSI layer model first. It explains how data is encapsulated when it travels from one networked peer to the other, and how specific layers are isolated from each other in terms of capabilities and information exchange. Browse to the list of example protocols.

When you send a ping request, it uses the ICMP protocol at the network layer (Layer 3). Ports are only a concept of the transport layer (Layer 4), so a ping does not know anything of ports, nor does it need to.

Specifically, it uses the echo reply message in ICMP and waits for a response.

A ping response just shows you that the remote machine is available through a network, but it does not say anything about which services are running on that machine or which ports are open. If you wanted to check if TCP port 80 is reachable, you would (in practice) have to use a program that can connect to TCP sockets (e.g. telnet), or in theory just open a connection via low-level operating system calls.

Note that some public-Internet facing servers might be configured not to respond to ICMP echo requests.

0
1

It doesn't use TCP or UDP(protocols that have a port), so there's no port.

Grab wireshark and look at the packet itself.

Just after IP is the ICMP protocol. The TCP protocol isn't used. There are no TCP fields there in the 'packet'. After IP is ICMP. (The word packet can refer to just part of what is sent or I think it can refer to the whole lot - I mean the latter - I believe that definition is used in telecomms).

Notice the highlighted part is the 'packet' in the specific sense, and that uses IP, see the IP fields highlighted. And past that is ICMP. It's much easier to see in wireshark itself. As you can click on different 'layers'/protocols, and see the correct bytes/fields highlighted.

The terminology that is often used is that of layers.using the ISO/OSI reference model but applied to the TCP/IP architecture. Layer 1 is physical, Layer 2 is the frame (you see there is Ethernet), Layer 3 is the packet. ICMP is a kind of layer 3.5 And there is no layer 4 because there is no TCP. "layers" are a way designers came up with of speaking of these fields.

When (in networking) people say Port, they mean TCP Port or UDP port. No TCP or UDP, then no Port. To use that OSI terminology - TCP and UDP exist at layer 4 , the transport layer, so, no port. But look in wireshark you see no TCP fields.

enter image description here

1
  • Very useful information. Two thumbs up! Nov 19, 2014 at 4:44

Not the answer you're looking for? Browse other questions tagged .