What is Ping? How It Works, Command Options and Reading the Output

Ping sends an ICMP Echo Request to a target and waits for an Echo Reply, measuring how long the round trip took. It is the first command almost every network problem gets diagnosed with, because it answers two questions at once: is the destination reachable, and how long does traffic take to get there and back.

It was written in 1983 by Mike Muuss and named after sonar, you send a pulse out and listen for the echo.

How Ping Works

1. You run ping 8.8.8.8. Your host builds an ICMP Echo Request (type 8, code 0) containing a sequence number, an identifier, and a block of padding data.
2. The packet is routed to the destination like any other IP packet.
3. The destination’s IP stack answers with an ICMP Echo Reply (type 0, code 0), copying the payload back unchanged.
4. Your host matches the reply to the request using the sequence number and reports the elapsed time.

Because ICMP is handled inside the IP stack rather than by an application, it has no port numbers at all, which is why “ICMP port” is a misnomer, a successful ping proves Layer 3 reachability, it says nothing about whether the web server, database or file share on that host is actually working.

Reading Ping Output

$ ping -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=12.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=11.9 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=118 time=13.1 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=118 time=12.0 ms

--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 11.912/12.362/13.148/0.472 ms

What the numbers should look like

Any packet loss to your own gateway is a fault. Loss to a distant host may just be rate limiting on an intermediate router.

Ping Command Options

Windows

Linux and macOS

Finding your path MTU with ping

Send a Don’t Fragment packet and shrink it until it gets through. On Windows, ping -f -l 1472 tests a 1500-byte MTU (1472 payload + 8 ICMP header + 20 IP header). If you get “Packet needs to be fragmented but DF set”, reduce the size. This is how you diagnose the MTU problems that break VPNs and PPPoE links while ordinary ping works fine.

Common Ping Errors and What They Mean

Why a Failed Ping Does Not Mean the Host Is Down

This is the most common misreading of ping. Many hosts and networks deliberately drop ICMP:

• Windows Firewall blocks inbound ICMP Echo by default on public and often private profiles. A perfectly healthy Windows machine will not answer a ping until you allow “File and Printer Sharing (Echo Request)”. Adding a rule is always better than disabling the firewall outright, and the Windows Firewall logs will confirm whether it is the one dropping your pings.
• Cloud security groups commonly permit only TCP 22, 80 and 443, ICMP is simply not in the rule set.
• Edge firewalls drop ICMP from the internet as a matter of policy.
• Routers rate-limit ICMP directed at their own control plane, so a hop showing loss in a traceroute is often fine at forwarding traffic.

When ping fails but you need to know whether a service is alive, test the port instead:

# Windows
Test-NetConnection example.com -Port 443

# Linux / macOS
nc -zv example.com 443

Ping vs Traceroute vs Pathping

mtr is the one to reach for on an intermittent problem, it runs continuously and shows per-hop loss and latency, which a single traceroute cannot.

Practical Troubleshooting Order

1. ping 127.0.0.1, proves your own TCP/IP stack works.
2. ping your own IP address, proves the NIC is configured.
3. ping your default gateway, proves the local network works.
4. ping 8.8.8.8, proves internet routing works.
5. ping google.com, proves DNS works. If step 4 succeeds and step 5 fails, it is DNS, not connectivity.

More diagnostics in our network troubleshooting commands guide.

Frequently Asked Questions

What is a good ping for gaming?

Under 30 ms feels instant, 30–60 ms is fine for most games, 60–100 ms is playable, and above 100 ms is noticeable in fast-paced titles. Consistency matters as much as the average, 40 ms with heavy jitter plays worse than a steady 70 ms.

Does ping measure download speed?

No. Ping measures latency, which is independent of bandwidth. A satellite link can have gigabit throughput and 600 ms ping; a slow DSL line can have 10 ms ping.

Why is my ping to the gateway high?

Over Wi-Fi, usually interference, distance or channel congestion, the same causes behind a laptop repeatedly disconnecting. Over Ethernet, anything above a couple of milliseconds points at a faulty cable, a duplex mismatch, or a badly overloaded switch.

Can ping be used to attack a host?

ICMP floods and the historic “ping of death” (an oversized fragmented packet) both used ping, which is part of why ICMP is filtered so widely. Modern stacks are not vulnerable to the ping of death, and volumetric ICMP floods are handled by rate limiting.

What TTL should I expect?

Initial TTL is 64 on Linux and macOS, 128 on Windows, 255 on most network devices. Subtract the value you see from the nearest of those to estimate the hop count.