ping
is the other end thereping sends an ICMP echo request and waits for the echo reply, reporting the round-trip time of each one and the loss across all of them. It proves the path works at the network layer in both directions — and nothing about any port or service above it.
A reply proves the path. Silence proves only that something, somewhere, dropped ICMP.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
56 bytes of data, plus 8 of ICMP header and 20 of IPv4 header, makes an 84-byte packet.
The reply left with a TTL of 64 and arrived with 56, so it crossed eight routers. icmp_seq going up without gaps means none were lost.
0% across four packets. Anything persistently above zero on a wired path is a fault worth chasing.
How far the times strayed from the average. Low and steady is a healthy path; a large mdev is what makes voice calls break up.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ping lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-c NUM- Send NUM requests, then stop and print the summary.
-i SECS- Wait this long between requests. The default is one second.
-s SIZE- Send this many bytes of data in each request.
-W SECS- Wait at most this long for each reply.
-t TTL- Set the starting TTL of the packets sent.
-I IFACE- Send from this interface or source address.
-4- Use IPv4 only. -6 is IPv6 only.
-q- Quiet: print only the summary at the end.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ping -c 4 -i 0.2 192.0.2.10Four packets, a fifth of a second apart — a faster sample.
ping -M do -s 1472 192.0.2.10Forbids fragmentation and sends a full 1500-byte packet. If it fails where a smaller one succeeds, the path MTU is lower.
ping -6 2001:db8::10The same test over IPv6, using ICMPv6.
ping -I eth0 192.0.2.10Sends from one named interface, to test a specific uplink on a multi-homed host.
In cybersecurity
ICMP is routinely filtered, so ping is a weaker test than it looks — and the protocol it rides is useful to attackers in ways echo requests hide.
Many hosts and most cloud firewalls drop echo requests. A host that does not answer ping may be serving perfectly on 443.
Pinging a whole range is the oldest way to find live hosts. Rate-limiting or filtering echo slows it, but does not stop a port scan.
Path MTU discovery depends on ICMP errors. Dropping everything breaks large transfers in ways that are painful to diagnose.
The echo payload can carry arbitrary data. Unusually large or frequent pings to one host deserve a second look.
The initial TTL — 64, 128 or 255 — suggests the operating system at the far end.
Echo requests to a broadcast address once drew replies from every host on it. Directed broadcasts should stay off.