Read

ICMP Echo — how ping works

ICMP (RFC 792) is IP's control channel. It rides directly inside IPv4 (protocol number 1, not 6 or 17) and carries the messages routers use to say "host unreachable", "TTL expired", "fragmentation needed" — and the two that ping is built on: Echo Request (type 8) and Echo Reply (type 0).

Echo message format

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |     Code      |          Checksum             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Identifier          |        Sequence Number        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Data (opaque, echoed verbatim)                            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Reply rule: copy the request bit-for-bit, flip Type from 8 → 0, recompute the checksum over the whole ICMP message (header + data) with the checksum field zeroed.

The checksum

Same algorithm as IPv4's, but over the ICMP bytes (not the IP header):

1. Set the checksum field to 0.
2. Sum 16-bit big-endian words; if the message length is odd, pad with one zero byte.
3. Fold carries: while sum >> 16: sum = (sum & 0xFFFF) + (sum >> 16).
4. 16-bit one's complement: (~sum) & 0xFFFF.

Why ping works

The kernel sends an echo request with id=PID, seq=N. The remote IP stack, if it likes the request, sends back the reply unchanged except for the type. ping times the round trip and re-uses the id/seq to match replies to requests. The data payload typically contains a timestamp so out-of-order replies can be measured correctly.

Operational notes

• Echo doesn't require a port (ICMP has no ports) — which is why firewalls block it more aggressively than TCP/UDP.
• Many cloud providers rate-limit ICMP. Your stack should accept arbitrary delays.
• Echo replies are sent even if the request crossed a NAT — the NAT box rewrites the id/checksum to keep the conversation flowing.