When a server (say Windows, Linux) is rebooted, it will take some time to respond to ping.

I'm assuming that the software firewall has to be up before pings will be returned as there might be a setting to disable ping responses.

Everyone knows that Windows and Linux have have totally different architectures so lets treat them separately.

The answer I'm looking for is "After XXX is running, pings will be returned." It would be helpful to know where in the boot order this is too. i.e. at the start or end.

I ask because we get questions from a customer about why it takes so long to respond to ping after creating a Virtual Machine. I'm sure this is just an artefact of the OS boot behaviour.

  • There are too many variables to give a specific, concise answer. How long does it take the NIC to establish a link? How long for the OS network stack to initialize? How long for the OS firewall (if there is one) to allow inbound ICMP Echo Requests? How long for the switch port to go into forwarding mode? Etc., etc. Also, ping doesn't imply that the server is functional in whatever role it is serving, so I don't see why anyone would care how long it takes to respond to pings.
    – joeqwerty
    Oct 25, 2013 at 15:32
  • @joeqwerty in some managed services, the failure to respond to ping is escalated to the owner of the server. When a new VM is started up there will be a certain delay until Ping replies starts and these are logged as failures. Picky customers have asked "Why are we getting alerts?". I want to know exactly what services have to be up for Ping to be returned. e.g. Naïve administrators may assume erroneously that the network card will return pings as soon as it gets power, but that is obviously incorrect. Oct 30, 2013 at 5:22

2 Answers 2


The firewall doesn't necessarily have to be up to respond to ICMP.

Once DHCP has taken place (or the nic has been brought up by a static IP) it will then listen for arp who-has requests for it's IP. In linux, this is once the interface configuration scripts are run, which vary in order from configuration to configuration. In windows, it's when the network related services are started. (Exact service name isn't coming to mind at the moment)

If the mac-address is not in any arp-caches there is an added delay in responding to the first ping as it has to learn the mac address for it's final ethernet hop to the host.

Some virtual machine's have an even longer initial delay due to the way it bridges ethernet adapters, the host has to learn and forward after a spanning tree delay to protect against loops.

In the boot order, the OS will start everything necessary to operate the network adapters, and then it brings the network adapter online before it brings any services dependent on networking up. This is usually in the "middle" on most machines that I've encountered.

  • You were faster than me! I was just writing when you posted. Nice answer :) Oct 25, 2013 at 11:43

I'll just add that it's not the firewall that responds to the ping request. It's the network card. The firewall only acts as a filter for an example - blocking your side from answering an ICMP ECHO request.

  • Obviously it is not the firewall that responds to ping nor is it the network card. If I am not mistaken, the card just places the Ethernet frames in a buffer for the operating system's TCP Stack/Driver to inspect and respond to. The firewall hooks into the TPC Stack to modify it's behaviour. i.e. to filter certain packets and/or to allow the TPC Stack to return or not return ICMP ECHO requests. I think you will find that the network card doesn't come into this discussion at all.. Oct 30, 2013 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.