What Is Ping and What Does Its Output Tell Me?

"Can you hear me now?"

Ping is one of the oldest and most basic network diagnostic tools. It's present in just about every modern, and even not-so-modern, operating system.

In concept, the tool is very simple: it sends out an "Are you there?" kind of request and expects to hear back a "Yes, here I am!" kind of response.

Very basic, very simple, and yet very powerful as a first line of network troubleshooting.

Ping

The ping command checks connectivity between devices by sending a request to a specific IP or domain and receiving a response. It measures round-trip time, identifies packet loss, and helps diagnose network issues. Results show whether the target is reachable and give details about the connection's speed and reliability.

The ping command line

The ping command runs in a Windows Command Shell (or a Linux/Mac/BSD/Solaris/etc. terminal window -- it's a very ubiquitous command), and has a basic syntax at its core:

ping domain_name

For example, if you open a command window and type in "ping askleo.com", you'll see something like this:

[C:]ping google.com

Pinging google.com [142.251.211.238] with 32 bytes of data:
Reply from 142.251.211.238: bytes=32 time=12ms TTL=56
Reply from 142.251.211.238: bytes=32 time=13ms TTL=56
Reply from 142.251.211.238: bytes=32 time=14ms TTL=56
Reply from 142.251.211.238: bytes=32 time=15ms TTL=56

Ping statistics for 142.251.211.238:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 12ms, Maximum = 15ms, Average = 13ms

Ping results

There's a lot of information in the results of a ping, and I'm not going into all the geeky details, but here are some of the basic and important things ping does.

• "Pinging google.com [142.251.211.238]" Ping only knows how to communicate with IP addresses, so the first thing it did when I asked it to ping "google.com" was to look up the corresponding IP address. This is one of the quickest ways I know to determine the IP address associated with a domain. Also, if this look-up fails, you'll know there's a typo in the domain name or the domain name look-up (DNS) is failing.
• "Reply from 142.251.211.238" This tells you that the remote server at that IP address replied. What that means, though, is that the entire route across the internet, from your machine through routers and switches and networking equipment and whatever else worked, as did the return path carrying the server's reply. If this fails ("timed out" will be in the response), something along the connection between you and the server might be broken, the server might be offline, or the server might not even exist. It's also possible the server is explicitly configured not to respond to ping requests.
• "time=12ms" This is the round-trip time: the time between sending "Are you there?" and receiving "Yes I am!". In this case, it took 12 milliseconds. Since the ping is repeated several times, you can see that this time is fairly consistent, which is good. The time depends on many factors, including how close you are to the remote server, how many routers and other networking equipment are between you and that server, and more. In the example above, the ping was from me in the Seattle area to a Google server housed in California(?). (My guess, since that's where Google's headquartered.)
• "Sent = 4, Received = 4" One of the things TCP/IP is designed to deal with is packet loss. Ideally, every packet you send should get to where it's going, but for various reasons, that doesn't always happen. As long as the packets can get there after a retry or two, in normal usage you'd never notice. Ping sends multiple packets and reports specifically on the success rate. This tells you if a particular connection is prone to packet loss.
• "Approximate round trip times" While the same kind of packet sent to the same destination should take roughly the same amount of time, that's also not always the case. Some packets take longer than others for reasons as diverse as the equipment involved and paths followed. Ping reports these statistics so you can see if a particular connection is prone to this type of problem.

Ping also includes several options (type "ping -?" for a list), but the simplest use, as above, is probably the most common.

What's your name?

There's one usage that is not intuitive but is something I use all the time. As you've seen above, ping can be used to translate a domain name quickly into its corresponding IP address (i.e. "google.com" into "142.251.211.238"). But it can also do the reverse.

[C:]ping -a 142.251.211.238
Pinging sea30s13-in-f14.1e100.net [142.251.211.238] with 32 bytes of data:
Reply from 142.251.211.238: bytes=32 time=17ms TTL=56...

When I add the "-a" switch to ping and give it an IP address, ping does what's called a "reverse DNS lookup" and displays the domain name assigned to that IP address. This is handy since many IP addresses are also assigned fairly descriptive domain names.

The results of a reverse DNS lookup can have three types of responses.

• The name of the website hosted at or domain assigned to that IP address
• The name of a server acting as a front-end (CDN) for a website

That's the case above. "sea30s13-in-f14.1e100.net" is a Google-owned domain used to make google.com faster by appearing closer to the person accessing it. Note the "sea" at the beginning, which indicates Seattle.

• The name of another website hosted at or domain assigned to the same IP address.

Shared hosting companies commonly place many websites on a single server and a single IP address. For example, checking a client's website, I found that over 3,000 other websites were at the same IP address. Reverse DNS could be set to return any of these, or, more typically, a server name that is meaningful to the hosting company.

A reverse DNS request can also come back without any results. A reverse DNS entry is not required.

Connectivity test

Aside from a quick tool for DNS and reverse-DNS look-ups, ping is most commonly used to verify basic connectivity between two machines. The ping service is one of the first services to be loaded onto a server and runs independently of any other. Often, websites may be inaccessible because of a software problem, but the server on which they are hosted still responds to a ping. That helps determine that there isn't a connectivity problem but a problem on the server itself.

It's also worth noting that some servers are disabled from responding to ping requests for assorted security-related reasons. For example, even though the server is most definitely up and running, as of this writing you cannot ping "askleo.com"; the request times out. This avoids some forms of DDOS attacks.

Pinging a site like "google.com" or "yahoo.com" is a quick way to ensure that your own internet connection is working.

Podcast audio

Download (right-click, Save-As) (Duration: 13:00 — 12.0MB)

Subscribe: RSS

Related Video