ping - The Command Born from Submarine Sonar

The first command you run when troubleshooting a network: ping. Its name comes from the "ping" sound made by submarine sonar (acoustic depth finders). Just as sonar emits a sound wave and measures distance by timing the reflected wave's return, ping sends a packet and measures network reachability and latency by timing the response.

The Birth of ping - Mike Muuss's Overnight Work in 1983

ping was written in December 1983 by Mike Muuss, an engineer at the US Army Ballistic Research Laboratory (BRL). It started with some odd behavior on BRL's IP network. Muuss remembered a suggestion he had heard from David Mills, that ICMP echo packets could be used to diagnose a path, and he had ping working before the night was over.

As Muuss later recounted, the name was inspired by submarine sonar. The operation of "sending a packet and waiting for the reflection" resembled sonar, so he intuitively named it "ping." Some sources claim it stands for "Packet InterNet Groper," but Muuss said that for him ping was never an acronym, only a sonar analogy, and that expansion is treated as a backronym, an acronym constructed after the fact.

ICMP - The Protocol Behind ping

ping uses ICMP (Internet Control Message Protocol) Echo Request and Echo Reply messages. Unlike TCP or UDP, ICMP is designed not for data transfer but for network control and diagnostics.

The operation of ping is straightforward:

  1. The source sends an ICMP Echo Request packet to the destination
  2. The destination receives the packet and sends back an ICMP Echo Reply
  3. The source measures the round-trip time (RTT)

This RTT is the fundamental metric for network latency that you can observe on IP Check-san. A ping from Tokyo to the US West Coast typically takes about 100-120 ms, and to Europe about 200-250 ms. Most of this latency is the physical time it takes light to travel through undersea cables.

What ping Can and Cannot Tell You

What It Can Tell You

  • Reachability: Whether the destination host is reachable on the network
  • RTT (round-trip latency): The time for a packet's round trip. Gives you a sense of the network "distance"
  • Packet loss: The percentage of sent packets that received no response. A network quality indicator
  • TTL (Time To Live): Allows estimation of how many routers the packet traversed. Subtracting the response TTL from the initial value (typically 64 or 128) gives the hop count

What It Cannot Tell You

  • Bandwidth: ping sends only tiny packets (typically 64 bytes), so it cannot measure actual connection speed
  • Service status: Even if ping gets a response, the web server or application may not be functioning properly
  • Exact route: ping cannot show which routers the packet traversed (that's traceroute's job)

No Response Doesn't Necessarily Mean an Outage

When ping gets no response, the target isn't necessarily down. Many servers and firewalls intentionally block ICMP Echo Requests for security reasons.

  • Windows Firewall: Configured to block ICMP Echo Requests by default
  • Cloud providers: AWS Security Groups block ICMP unless explicitly allowed
  • DDoS protection: Many networks rate-limit or block ICMP to prevent Ping Flood attacks using massive ICMP packets

If ping doesn't get through, try connecting to a specific port with curl or telnet, or use traceroute to see how far you can reach. Note that on public Wi-Fi networks, ICMP may be blocked entirely by the access point, so a failed ping doesn't always indicate a problem with the destination.

Commands Derived from ping

Lined up next to ping itself, it becomes clear what each command is built to measure.

Command What it sends What it tells you Where it is used
ping An ICMP Echo Request, then receives the Echo Reply that comes back Reachability, RTT (round-trip latency), packet loss, and the hop count estimated from TTL Finding out whether a host is reachable and roughly how far away it is. It cannot tell you bandwidth, service status, or the exact route
traceroute / tracert Packets sent with the TTL raised one step at a time (Unix traceroute uses UDP by default, Windows tracert uses ICMP Echo Request) The IP address and latency of each router along the path to the destination Seeing the route that ping cannot show, and checking how far packets get when ping gets no response
mtr (My Traceroute) A combination of ping and traceroute, sent continuously Real-time, continuously updated latency and packet loss for each hop Watching which hop along the path is losing quality
fping Pings to multiple hosts simultaneously The response status of many hosts at once Large-scale network monitoring
hping Packets using any protocol, including TCP, UDP, and ICMP How a host responds to protocols other than ICMP Firewall testing and port scanning, including against hosts that block ICMP

What Happened to Mike Muuss

Mike Muuss, the creator of ping, was also known as the developer of BRL-CAD (an open-source 3D CAD system). Sadly, he passed away in a traffic accident in November 2000 at the age of 42.

More than 40 years after its birth in 1983, the tool he wrote in a single night was still in daily use by network engineers around the world as of 2026. Simple, reliable, and universal - it may be the ideal form of great software.

Related Terms

IP Address The identifier for devices on the internet, specified as the destination for ping. Latency The fundamental concept behind the RTT (round-trip time) that ping measures. Depends on physical distance and network equipment processing time. Firewall Can be configured to block ICMP, preventing ping responses. Widely adopted for security reasons. DNS When a hostname is specified in ping, it is first resolved to an IP address via DNS. DNS latency is included in the RTT. ISP The first network that ping packets traverse. ISP quality directly affects ping results.

Frequently Asked Questions

Where does the name 'ping' come from?

The name comes from the sound that submarine sonar makes. Mike Muuss, who wrote the original ping program in 1983, named it after the sonar pulse sound because the tool works similarly: it sends out a signal and listens for the echo to measure distance (latency).

Does a failed ping mean the server is down?

Not necessarily. Many servers and firewalls are configured to block ICMP packets (which ping uses) for security reasons. A failed ping could mean the server is down, but it could also mean ICMP is being filtered somewhere along the path.

Can ping measure internet speed?

No. Ping measures round-trip time (latency), not bandwidth. A low ping time means the connection is responsive, but it does not indicate how much data can be transferred per second. Speed tests use large data transfers to measure throughput.