What is ICMP Echo Request/Reply
ICMP Echo Request/Reply, commonly known as “ping,” is the most basic ICMP message used to verify IP reachability between two hosts. The sender transmits an Echo Request (Type 8), and if the destination receives it, it returns an Echo Reply (Type 0). A returned reply confirms that IP packets can travel successfully in both directions between the two hosts.
Defined in RFC 792, Echo Request/Reply is classified as an ICMP “query message.” Unlike error messages, its purpose is simply to confirm that communication is working normally.
Packet Format
The “Rest of Header” of an Echo Request/Reply holds an Identifier and Sequence Number used to correlate requests with their replies.
| Field Name | Size | Description |
|---|---|---|
| Type | 1 byte | 8 for Echo Request, 0 for Echo Reply. |
| Code | 1 byte | Always 0. |
| Checksum | 2 bytes | An error-detection value covering the entire ICMP message (Type through Data). |
| Identifier | 2 bytes | A value identifying a series of Echo Request/Reply exchanges. Often an implementation-dependent value such as a process ID, so that multiple processes or sessions running ping concurrently are not confused with one another. |
| Sequence Number | 2 bytes | A sequence number that increments with each transmission within the same Identifier. Used to detect packet loss and reordering. |
| Data | Variable | Arbitrary padding data. Whatever the sender sets is echoed back unchanged in the Echo Reply. |
An Echo Reply carries forward the Identifier, Sequence Number, and Data of the Echo Request it received, unchanged. The sender matches these three values to identify which request a given reply corresponds to.
Behavior
The basic flow when R1 (192.168.0.1) runs ping against R2 (192.168.0.2):
sequenceDiagram
participant R1 as R1
192.168.0.1
participant R2 as R2
192.168.0.2
R1->>R2: ICMP Echo Request
Type: 8, Code: 0
Identifier: 0x0001, Seq: 1
R2->>R1: ICMP Echo Reply
Type: 0, Code: 0
Identifier: 0x0001, Seq: 1
R1->>R2: ICMP Echo Request
Identifier: 0x0001, Seq: 2
R2->>R1: ICMP Echo Reply
Identifier: 0x0001, Seq: 2
Note over R1: Checks Sequence Number continuity
to detect packet loss
- R1 sends an Echo Request (Type 8) with R2 as the destination IP address. The Identifier and Sequence Number are managed by the sending process.
- When R2 receives the Echo Request, it swaps the source and destination IP addresses and returns the received Identifier, Sequence Number, and Data unchanged as an Echo Reply (Type 0).
- R1 receives the Echo Reply, confirms that the Sequence Number matches a Request it sent, and measures the round-trip time (RTT).
- If no reply is received within a certain time, the packet for that Sequence Number is considered lost.
Verification on Real Hardware
Using R1 and R2 (Cisco IOS XE, with GigabitEthernet1 interfaces directly connected to each other), we ran ping 192.168.0.2 from R1 and confirmed the behavior of ICMP Echo Request/Reply using a packet capture and the ICMP counters in show ip traffic.
ping Command Output
R1#ping 192.168.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms
R1#All 5 probes received a reply (five ! marks), for a 100% success rate, with a round-trip time (RTT) of 2ms minimum, 2ms average, and 3ms maximum.
Packet Capture (Echo Request / Echo Reply)
The capture of the first exchange (Sequence Number 0):
Ethernet II, Src: 52:54:00:83:54:c2, Dst: 52:54:00:c2:81:b1
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.0.1, Dst: 192.168.0.2
Total Length: 100
Time to Live: 255
Protocol: ICMP (1)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xf26b
Identifier: 0x0001 (1)
Sequence Number: 0x0000 (0)
Data (72 bytes)Ethernet II, Src: 52:54:00:c2:81:b1, Dst: 52:54:00:83:54:c2
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.0.2, Dst: 192.168.0.1
Total Length: 100
Time to Live: 255
Protocol: ICMP (1)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0xfa6b
Identifier: 0x0001 (1)
Sequence Number: 0x0000 (0)
Data (72 bytes)Source MAC address 52:54:00:83:54:c2 is R1, and 52:54:00:c2:81:b1 is R2’s GigabitEthernet1. In the Echo Reply, the Ethernet header’s destination/source MAC addresses and the IP header’s destination/source IP addresses are swapped, while the ICMP Identifier (0x0001) and Sequence Number (0x0000) are returned unchanged from the Echo Request — confirming, as described above, that the sender can correlate a reply using these two values.
0xABCD pattern as its default ping payload.Confirming ICMP Statistics with show ip traffic
R1#show ip traffic
<snip>
ICMP statistics:
Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 0 unreachable
0 echo, 5 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
0 time exceeded, 0 info replies
Sent: 0 redirects, 0 unreachable, 5 echo, 0 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 0 timestamp replies
0 info reply, 0 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements
<snip>
R1#R2#show ip traffic
<snip>
ICMP statistics:
Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 0 unreachable
5 echo, 0 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
0 time exceeded, 0 info replies
Sent: 0 redirects, 0 unreachable, 0 echo, 5 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 0 timestamp replies
0 info reply, 0 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements
<snip>
R2#R1 shows “Sent: 5 echo” and “Rcvd: 5 echo reply,” while R2 shows the reverse — “Rcvd: 5 echo” and “Sent: 5 echo reply.” This confirms that the 5 pings (Echo Requests sent, Echo Replies received) are correctly reflected in each device’s ICMP statistics.
Download icmp_echo_request_reply.pcap
Download R1 config (r1_icmp_echo_request_reply.cfg)
Download R2 config (r2_icmp_echo_request_reply.cfg)
Common ping Command Options
The basic behavior of the ping command is common across operating systems, but the default send interval, packet size, and number of transmissions differ.
| OS/Device | Example Command | Notes |
|---|---|---|
| Linux | ping -c 4 192.168.0.2 | By default, keeps sending until stopped. Use -c to specify a count. |
| Windows | ping 192.168.0.2 | By default, sends 4 times and stops. |
| macOS | ping -c 4 192.168.0.2 | Like Linux, keeps sending by default. |
| Cisco IOS XE | ping 192.168.0.2 | By default sends 5 times, showing ! for success or . for timeout. |