How PING works on a Windows machine

[siddhartham]

I know ping uses the identifier field ICMP packet in Linux to deffrentiate between different echo replys but in windows the identifier field is set to 255 for all the echo replys.Can someone please explain on how does ping differentiates the echo replys from different echo requests on a windows machine.

[milan.kulik]

Hi,

do you mean the Identifier and Sequence Number?

" The Identifier and Sequence Number can be used by the client to match the reply with the request that caused the reply. In practice, most Linux systems use a unique identifier for every ping process, and sequence number is an increasing number within that process. Windows uses a fixed identifier, which varies between Windows versions, and a sequence number that is only reset at boot time."

See http://en.wikipedia.org/wiki/Ping

for other details of Echo request format.

HTH,

Milan

[siddhartham]

Thanks for your time Milan. I know that windows uses fixed identifier(255) in the identifier field but that is my question if it uses the same identifier for all echo requests (unlike linux) how will it match the echo replys back to the requests.

[milan.kulik]

Hi,

I ran some tests with Wireshark on my PC and I saw even while two Ping sessions were running at the same time, no sequence number was in clash.

So I believe Windows processes are somehow synchronizing the sequence numbers they are using.

BR,

Milan

[siddhartham]

I found the below document which explains the basics about PING and how Linux differentiates between different echo replys ( diff simultaneous ping sessions) but that didn't explain about Windows.The document was written by George Mays and its very informative.

http://www.galaxyvisions.com/pdf/white-papers/How_does_Ping_Work_Style_1_GV.pdf

[siddhartham]

anyone have idea how it works on windows