50

Yesterday interviewer ask me what is port number for ping and which protocol ping use TCP/UDP.

After interview I search on internet and found different different results someone says ICMP uses Port 7, someone says it does not use port number, on one site I found it usese IP protocol 1, etc.

Can anyone help me with the correct explanation?

Regards, Nishad

  • 2
    TCP and UDP are layer-4 protocols, and ports are TCP or UDP addresses, but ICMP is part of IP (layer-3). From RFC 792: "ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module." – Ron Maupin Jan 9 '17 at 14:54
  • 1
    Discussing layers is a bit misleading here as ICMP, TCP, and UDP ride directly over IP as protocols 1, 6, and 17 respectively. To the OP, review the headers for ICMP/TCP/UDP or run a packet capture to see how they differ. Just remember that ICMP is completely separate from TCP and UDP. – cmschmidt15 Jan 9 '17 at 22:29
  • Did you get the job? – Janac Meena Feb 1 at 16:04
  • 1
    Yes I got the job. – Nishad Morey Feb 3 at 12:57
62

The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports!

See RFC792 for further details.

  • 5
    To clarify, ICMP rides directly over IP as IP protocol 1. Within the ICMP header you have the echo/echo reply, etc. types. Compare this to TCP and UDP which ride over IP as IP protocols 6 and 17, respectively, and use their own port system for differentiating applications. – cmschmidt15 Jan 9 '17 at 22:19
5

I'd like to give you an additional answer especially to this part of the question:

... someone says ICMP uses Port 7

Port 7 (both TCP and UDP) is used for the "echo" service.

If this service is available on a computer, UDP port 7 could be used instead of ICMP to perform a "ping".

However, most modern computers don't have the "echo" service running, so performing "ping" using UDP port 7 instead of ICMP would not work.

And: As the words "instead of ICMP" already indicate, "ping" over UDP port 7 does NOT use ICMP but UDP, which is a completely different protocol!

  • As a rebuttal to your answer, here is a post someone said on a forum I found about this topic: "People who do think that ICMP somehow uses port 7 (the old echo service where it would echo every character you sent to it) should not be in networking and should be shot. If you do not agree with what I have said, look at the structure of an IP datagram and of an ICMP datagram. The ICMP is encapsulated in the IP datagram and then the IP datagram into whatever the particular media needs to form the frame." – Jesse P. Jan 3 at 15:32
  • "ICMP does not use a port since it does not have a place for a port. It is encapsulated with an IP datagram only. You will find the port option only on UDP and TCP datagrams. To block ICMP echo, you would explicitly block the type and code" – Jesse P. Jan 3 at 15:32
  • Full forum topic is community.infosecinstitute.com/discussion/8777 – Jesse P. Jan 3 at 15:33
  • @JesseP. Did I write that ICMP uses port 7? No. I even wrote the word "instead" in "instead of ICMP" bold to indicate that port 7 has nothing to do with ICMP. I'll edit my answer a bit to make this clearer. – Martin Rosenau Jan 3 at 16:04
  • That's fair. It was a bit confusing to read. Sorry. – Jesse P. Jan 3 at 16:12
2

As others have already stated, in general pings are ICMP based and have no ports. There is, however, such a thing as TCP Ping where, instead of the typical 3-way TCP handshake, only the first 2 steps are performed and the delay between is measured. Once the measurement has completed, a RST ACK is sent to close the half-open connection. Then the process repeats until the counter/duration is reached or you terminated the process. Using TCP Ping (which I use FREQUENTLY to test for open ports on servers my systems admins work on) you are able to specify destination ports to test (to verify a server is listening on a certain port). The source port is just an ephemeral random port.

If you'd like to see an example of a TCP Ping utility (the one I use on Windows systems), here you go: TCPing. Also, NMAP comes with a utility called NPING which has a flag to allow it to perform TCP based pings too.

As a note, some network equipment also has this capability, such as Cisco ASAs using some of the newer operating system versions. The command is: ping tcp <destination IP> <destination port>

1

Ping use not port but protocol. Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waiting for an ICMP echo reply. However, as a security consideration, this is often disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.