Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a follow up on Why Doesn't Ping Show RTT?

I had a look at BSD, Linux and BusyBox ping implementations. All three share the feature that they calculate the round trip time by sending a timestamp as echo request, receive it back as echo reply and then subtract the received timestamp from the current time.

Obviously the target host could modify the timestamp before it echoes it back, giving weird ping output. In addition to that, icmp protocol specification does not talk about timestamps at all. It's just stored in the payload field. If you modify the size of the payload to be too small to store the timestamp, ping is unable to calculate the round trip time.

I already patched a ping implementation to save the timestamps and not to rely on the echo. It seems to work perfectly, but I'm unsure if I'm breaking anything (in real life scenarios, the patch totally obeys the standards).

My questions:
1) Do I break anything?
2) What reason could the designer of ping have had for implementing it in such a non-obvious way?

share|improve this question
From wikipedia: "This allows ping to compute the round trip time in a stateless manner without needing to record when packets were sent." Also, the ICMP protocol does not specifically talk about timestamps but it says the data in the echo request must be returned in the echo reply. – Mark Wagner Feb 17 '12 at 19:41
What's the reason making it stateless? Memory consumption? What if someone sends manipulated echoes, intentionally or not? Since ping is stateless, it could not even detect if someone does plays with it. – Max Ried Feb 17 '12 at 19:50
The designer of the original ping is Mike Muus Sadly, Mike died in a car accident in 2000. Here is a great quote from Mike's ping page: I was insanely jealous when Van Jacobson of LBL used my kernel ICMP support to write TRACEROUTE, by realizing that he could get ICMP Time-to-Live Exceeded messages when pinging by modulating the IP time to life (TTL) field. I wish I had thought of that! :-) Of course, the real traceroute uses UDP datagrams because routers aren't supposed to generate ICMP error messages for ICMP messages." The link has some great reading. – davey Feb 17 '12 at 20:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.