Friday, May 14, 2010

What is PING?

Ping is a computer network tool used to test whether a particular host is reachable across an IP network. Ping works by sending ICMP “echo request” packets ("Ping?") to the target host and listening for ICMP “echo response” replies (sometimes dubbed "Pong!" as an analog from the Ping Pong table tennis sport.) Using interval timing and response rate, ping estimates the round-trip time (generally in milliseconds although the unit is often omitted) and packet loss (if any) rate between hosts.

The word ping is also frequently used as a verb or noun, where it can refer directly to the round-trip time, the act of running a ping program or measuring the round-trip time.

Mike Muuss wrote the program in December, 1983, as a tool to troubleshoot odd behavior on an IP network. He named it after the pulses of sound made by a sonar, since its operation is analogous to active sonar in submarines, in which an operator issues a pulse of energy (a network packet) at the target, which then bounces from the target and is received by the operator. Later David L. Mills provided a backronym, "Packet INternet Grouper (Groper)", also by other people "Packed IN(ternet) Gopher", after the small rodents.

The usefulness of ping in assisting the "diagnosis" of Internet connectivity issues was impaired from late inp 2003, when a number of Internet Service Providers filtered out ICMP Type 8 (echo request) messages at their network boundaries. This was partly due to the increasing use of ping for target reconnaissance, for example by Internet worms such as Welchia that flood the Internet with ping requests in order to locate new hosts to infect. Not only did the availability of ping responses leak information to an attacker, it added to the overall load on networks, causing problems to routers across the Internet.

There are two schools of thought concerning ICMP on the public Internet: those who say it should be largely disabled to enable network 'stealth', and those who say it should be enabled to allow proper Internet diagnostics.

These two schools of thought merge when considering intranet/extranet networks within the same organization. An example would be an organization which maintains 'buffer' network(s) to shield said net from the raw internet, such a network is usually described as a DMZ (after the military designation 'demilitarized zone'). In such a scenario an organization would maintain both a network(s) that would allow ICMP packets to radiate within the internal (trusted network), and disallow ICMP (ping) packets in a separated network that would more often than not include raw internet facing systems

No comments: