ping
ping tests reachability with ICMP Echo Request/Reply. It ships on Windows, Linux, and macOS with incompatible default behaviors and flag sets — the classic cross-platform footgun:
| Purpose | Linux (iputils) | Windows |
|---|---|---|
| Count of echo requests | -c 4 | -n 4 |
| Payload size (bytes) | -s 1472 | -l 1472 |
| Timeout per reply | -W 2 (seconds) | -w 2000 (milliseconds) |
| TTL/hop limit | -t 64 | -i 64 |
| Don’t fragment | -M do | -f |
| Flood / continuous | -f (flood, root only) | -t (continuous, Ctrl+C / Ctrl+Break for stats) |
| Resolve names | -n disables | -a enables |
Two killer differences to memorize: Linux pings forever by default (-c to stop; Windows sends exactly 4), and -t means opposite things (TTL on Linux, continuous-ping on Windows). Running Linux-style ping -t 64 host on Windows pins a terminal pinging forever.
Operational notes
- Windows
ping -a <ip>attempts reverse DNS — quick hostname hints during discovery (T1018-adjacent; see windows-reconnaissance-commands). ping -f -l 1472(Windows) /ping -M do -s 1472(Linux) probes path MTU.- Many networks filter ICMP — a failed ping proves nothing; use TCP-based probes (
Test-NetConnection -Porton PowerShell, or see powershell-port-scanning). - Sweeping a subnet from Windows without tools:
for /l %i in (1,1,254) do @ping -n 1 -w 100 192.168.1.%i | find "TTL".
Related
- ipconfig — the neighboring Windows network-inspection tool
- icmp — the protocol ping speaks: types, codes, and why filtering breaks PMTUD
- powershell-port-scanning — what to use when ICMP is filtered
- windows-reconnaissance-commands — built-in network discovery commands