Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm creating a Tracert program and am wondering if the value "buffer" used in the Ping payload really matters. Can it be anything, or do routers respond differently based on the contents of the buffer?

What about the other parts of an ICMP ping message? Don't Fragment, etc...

I found one sample that sets the buffer like this:

    byte[] Buffer
            if (_buffer == null)
                _buffer = new byte[32];
                for (int i = 0; i < Buffer.Length; i++)
                    _buffer[i] = 0x65;
            return _buffer;

locked by HopelessN00b Feb 17 '15 at 18:43

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

No, the data section of an ICMP echo is not meaningful.

It serves as a means to make the request and reply packets larger (potentially past the point of fragmentation, the path's MTU) to test network conditions, but is not handled in any way by ICMP implementations (aside from being copied into the echo reply by a responding device).

Will any WAN optimization features have an effect here, or does it not matter for these purposes? – LamonteCristo Sep 1 '11 at 18:06
Some OSes (particularly Windows) include timestamps in echo requests and replies. – Gerald Combs Sep 1 '11 at 18:14
Interesting question - I suppose if a compressing optimizer were set to act on ICMP packets, with a remote peer decompressing (which wouldn't make a ton of sense, really - they aren't a ton of traffic and you can't really improve the metric that matters for them, response time), then a packet with pure random data in that section would compress less well than one that just sticks predictable data in there, such as the 0x65 in every byte above. It'd completely depend on the optimizer, though. – Shane Madden Sep 1 '11 at 18:16

The data section of an echo request is optional. You only need to include it if you wish to

  • make the message larger to test for fragmentation-realated problems
  • test whether specific bit-patterns cause problems for your network devices (e.g. they might interpret long strings of ones or zeroes as a command to enter test mode)

A good reference on this topic is Eric Hall's Internet Core Protocols.

Isn't the data section (of some length) required with the no-fragment set? – LamonteCristo Sep 1 '11 at 18:26
On linux, I just ran ping -M do -s 0 localhost (which sets don't fragment and does not have a data section) without any trouble. – sciurus Sep 1 '11 at 21:04

It depends. For timestamps, redirects, and unreachable messages the payload contains valuable information. Even echo request and reply payloads can contain information like timestamps.

You say that you're writing a traceroute program, but then you use the phrase "Ping payload" which suggests that you're trying to process ICMP echo requests and replies. While it's certainly possible to use ICMP messages for tracing routes (it's your only option with tracert on Windows) you won't be able to trace the complete path in many cases since overzealous admins often block echoes.

You might want to consider using other protocols for your probes, specifically TCP. When tracing the route to a web server for example, traceroute (which uses UDP by defualt) or tracert (ICMP) isn't nearly as useful as nmap -Pn --traceroute -p 80 or tcptraceroute.

I'm a little confused by this answer... can you be more detailed on the protocols used? Comparing UDP against ICMP isn't clear to me. – LamonteCristo Sep 1 '11 at 18:15
You're trying to write a traceroute program, correct? Traceroute works by sending probes with low IP (not ICMP) time-to-live values and looking for matching ICMP time-to-live exceeded responses. Although the responses will always be ICMP, the probes themselves can be any protocol that runs on top of IP -- ICMP, UDP, TCP, SCTP, AH, ESP, etc. – Gerald Combs Sep 1 '11 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.