Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How can I know when my computer is pinged?

I'm using Linux. I would like to know how to tell who is pinging my computer. I have seen this similar question using Windows, but I'm not sure it applies to me.

share|improve this question

marked as duplicate by Chris S Nov 14 '12 at 18:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Same principles apply: Sniff the traffic on the network, or have yor local firewall log ICMP Echo requests your system sees... –  voretaq7 Nov 14 '12 at 16:32
add comment

2 Answers 2

up vote 7 down vote accepted

It looks like you're asking how to see who's pinging you, right? One quick and dirty way would be using tcpdump to simply monitor all incoming ICMP echo requests:

sudo tcpdump -i ethX icmp and icmp[icmptype]=icmp-echo

where ethX is the name of the adapter you're interested in listening to.

Note that tcpdump will resolve hostnames by default, so you might need to add the -n option to get IPs instead.

(This is, by the way, basically identical to the instructions given in the question you linked, though they are for Wireshark, a related but separate tool.)

share|improve this answer
add comment

You can use tcpdump like this

tcpdump ip proto \\icmp

and you get this kind of output

09:25:22.650727 IP 192.168.1.69 > centos6.lan: ICMP echo request, id 1, seq 1, l ength 40 09:25:22.650816 IP centos6.lan > 192.168.1.69: ICMP echo reply, id 1, seq 1, len gth 40

You could use iptables too

 iptables -I INPUT -p icmp --icmp-type 8 -m state  --state NEW,ESTABLISHED,RELATED -j LOG --log-level=1 --log-prefix "Ping Request "

and get messages like this in /var/log/messages (on CentOS at least)

Nov 14 09:43:35 centos6 kernel: Ping Request IN=eth0 OUT= MAC=00:0c:29:d2:2c:38:00:0c:29:fe:8e:bb:08:00 SRC=192.168.1.69 DST=192.168.254.188 LEN=60 TOS=0x00 PREC=0x00 TTL=126 ID=6551 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=37

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.