Yesterday an interviewer asked me what the port number for ping is and which protocol ping uses: TCP or UDP.

After the interview, I searched on the Internet and found different results: someone says ICMP uses port 7, someone says it does not use any port number, on one site I found it uses IP protocol 1, etc.

Can anyone help me with the correct explanation?

  • 7
    TCP and UDP are layer-4 protocols, and ports are TCP or UDP addresses, but ICMP is part of IP (layer-3). From RFC 792: "ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module."
    – Ron Maupin
    Jan 9, 2017 at 14:54
  • 2
    Discussing layers is a bit misleading here as ICMP, TCP, and UDP ride directly over IP as protocols 1, 6, and 17 respectively. To the OP, review the headers for ICMP/TCP/UDP or run a packet capture to see how they differ. Just remember that ICMP is completely separate from TCP and UDP. Jan 9, 2017 at 22:29
  • 1
    Did you get the job? Feb 1, 2019 at 16:04
  • 10
    Yes I got the job. Feb 3, 2019 at 12:57

5 Answers 5


The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports!

See RFC792 for further details.

  • 11
    To clarify, ICMP rides directly over IP as IP protocol 1. Within the ICMP header you have the echo/echo reply, etc. types. Compare this to TCP and UDP which ride over IP as IP protocols 6 and 17, respectively, and use their own port system for differentiating applications. Jan 9, 2017 at 22:19
  • 2
    "ICMP has no ports!" Though it does have query IDs which are treated like ports in certain circumstances (notablly circumstances related to NAT). Nov 30, 2019 at 6:25
  • Re: The standard ping command does not use TCP Unless you tell it to use TCP, right?
    – Ben Slade
    Aug 11, 2023 at 13:56

I'd like to give you an additional answer especially to this part of the question:

... someone says ICMP uses Port 7

Port 7 (both TCP and UDP) is used for the "echo" service.

If this service is available on a computer, UDP port 7 could be used instead of ICMP to perform a "ping".

However, most modern computers don't have the "echo" service running, so performing "ping" using UDP port 7 instead of ICMP would not work.

And: As the words "instead of ICMP" already indicate, "ping" over UDP port 7 does NOT use ICMP but UDP, which is a completely different protocol!

  • As a rebuttal to your answer, here is a post someone said on a forum I found about this topic: "People who do think that ICMP somehow uses port 7 (the old echo service where it would echo every character you sent to it) should not be in networking and should be shot. If you do not agree with what I have said, look at the structure of an IP datagram and of an ICMP datagram. The ICMP is encapsulated in the IP datagram and then the IP datagram into whatever the particular media needs to form the frame."
    – Jesse P.
    Jan 3, 2019 at 15:32
  • "ICMP does not use a port since it does not have a place for a port. It is encapsulated with an IP datagram only. You will find the port option only on UDP and TCP datagrams. To block ICMP echo, you would explicitly block the type and code"
    – Jesse P.
    Jan 3, 2019 at 15:32
  • Full forum topic is community.infosecinstitute.com/discussion/8777
    – Jesse P.
    Jan 3, 2019 at 15:33
  • 5
    @JesseP. Did I write that ICMP uses port 7? No. I even wrote the word "instead" in "instead of ICMP" bold to indicate that port 7 has nothing to do with ICMP. I'll edit my answer a bit to make this clearer. Jan 3, 2019 at 16:04
  • That's fair. It was a bit confusing to read. Sorry.
    – Jesse P.
    Jan 3, 2019 at 16:12

As others have already stated, in general pings are ICMP-based and have no ports. There is, however, such a thing as TCP Ping where, instead of the typical 3-way TCP handshake, only the first 2 steps are performed and the delay between is measured. Once the measurement has completed, a RST ACK is sent to close the half-open connection. Then the process repeats until the counter/duration is reached or you terminate the process. Using TCP Ping (which I use FREQUENTLY to test for open ports on servers my systems admins work on) you are able to specify destination ports to test (to verify a server is listening on a certain port). The source port is just an ephemeral random port.

If you'd like to see an example of a TCP Ping utility (the one I use on Windows systems), here you go: TCPing. Also, NMAP comes with a utility called NPING which has a flag to allow it to perform TCP based pings too (I use that on macOS and Linux systems).

As a note, some network equipment also has this capability, such as Cisco ASAs using some of the newer operating system versions. The command is: ping tcp <destination IP> <destination port>


Ping use not port but protocol. Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waiting for an ICMP echo reply. However, as a security consideration, this is often disabled.


Ping on Windows & Linux systems by default use ICMP. A ping Request will be Type 8 & Code 0 A ping Reply will be Type 0 & Code 0

There are other utilities you can use to run a ping like test for TCP/UDP. A common quick test for seeing if a TCP port is open is using the telnet client on Windows. Nmap is a third party utility you can use on Windows and Linux to test open ports.

Traceroute on Windows uses ICMP and Linux actually uses UDP by default.

You can verify this by using wire shark to capture traffic to see how these operating systems use troubleshooting tools.

The question was probably more to test your knowledge on troubleshooting utilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.