CmdID

CmdID / Commands

ping

Verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message Protocol (ICMP) echo Request messages. Windows commands reference

On Windows, Linux, macOS 10 Sigma rules name it File ping.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message Protocol (ICMP) echo Request messages. The receipt of the corresponding echo Reply messages is displayed, along with round-trip times. ping is the primary TCP/IP command used to troubleshoot connectivity, reachability, and name resolution. Used without parameters, this command displays Help content. You can also use this command to test both the computer name and the IP address of the computer. If pinging the IP address is successful, but pinging the computer name isn't, you might have a name resolution problem. In this case, make sure the computer name you're specifying can be resolved through the local Hosts file, by using Domain Name System (DNS) queries, or through NetBIOS name resolution techniques. NOTE: This command is available only if the Internet Protocol (TCP/IP) is installed as a component in the properties of a network adapter in Network Connections.

ping [/t] [/a] [/n <count>] [/l <size>] [/f] [/I <TTL>] [/v <TOS>] [/r <count>] [/s <count>] [{/j <hostlist> | /k <hostlist>}] [/w <timeout>] [/R] [/S <Srcaddr>] [/4] [/6] <targetname>
C:>ping example.microsoft.com
pinging example.microsoft.com [192.168.239.132] with 32 bytes of data:
Reply from 192.168.239.132: bytes=32 time=101ms TTL=124
Reply from 192.168.239.132: bytes=32 time=100ms TTL=124
Reply from 192.168.239.132: bytes=32 time=120ms TTL=124
Reply from 192.168.239.132: bytes=32 time=120ms TTL=124
ping /a 10.0.99.221
ping /n 10 /l 1000 10.0.99.221
ping /r 4 10.0.99.221
ping /j 10.12.0.1 10.29.3.1 10.1.44.1 10.0.99.221
Show 18 options
/tSpecifies ping continue sending echo Request messages to the destination until interrupted. To interrupt and display statistics, press CTRL+BREAK. To interrupt and quit this command, press CTRL+C.
/aSpecifies reverse name resolution be performed on the destination IP address. If this operation is successful, ping displays the corresponding host name.
/n <count>Specifies the number of echo Request messages be sent. The default is 4.
/l <size>Specifies the length, in bytes, of the Data field in the echo Request messages. The default is 32. The maximum size is 65,500.
/fSpecifies that echo Request messages are sent with the Do not Fragment flag in the IP header set to 1 (available on IPv4 only). The echo Request message can't be fragmented by routers in the path to the destination. This parameter is useful for troubleshooting path Maximum Transmission Unit (PMTU) problems.
/i <TTL>Specifies the value of the Time To Live (TTL) field in the IP header for echo Request messages sent. The default is the default TTL value for the host. The maximum TTL is 255.
/v <TOS>Specifies the value of the Type Of Service (TOS) field in the IP header for echo Request messages sent (available on IPv4 only). The default is 0. TOS is specified as a decimal value from 0 through 255.
/r <count>Specifies the Record Route option in the IP header is used to record the path taken by the echo Request message and corresponding echo Reply message (available on IPv4 only). Each hop in the path uses an entry in the Record Route option. If possible, specify a count equal to or greater than the number of hops between the source and destination. The count must be a minimum of 1 and a maximum of 9.
/s <count>Specifies that the Internet timestamp option in the IP header is used to record the time of arrival for the echo Request message and corresponding echo Reply message for each hop. The count must be a minimum of 1 and a maximum of 4. This parameter is required for link-local destination addresses.
/j <hostlist>Specifies the echo Request messages use the Loose Source Route option in the IP header with the set of intermediate destinations specified in hostlist (available on IPv4 only). With loose source routing, successive intermediate destinations can be separated by one or multiple routers. The maximum number of addresses or names in the host list is 9. The host list is a series of IP addresses (in dotted decimal notation) separated by spaces.
/k <hostlist>Specifies the echo Request messages use the Strict Source Route option in the IP header with the set of intermediate destinations specified in hostlist (available on IPv4 only). With strict source routing, the next intermediate destination must be directly reachable (it must be a neighbor on an interface of the router). The maximum number of addresses or names in the host list is 9. The host list is a series of IP addresses (in dotted decimal notation) separated by spaces.
/w <timeout>Specifies the amount of time, in milliseconds, to wait for the echo Reply message corresponding to a given echo Request message. If the echo Reply message isn't received within the time-out, the "Request timed out" error message is displayed. The default time-out is 4000 (4 seconds).
/RSpecifies the round-trip path is traced (available on IPv6 only).
/S <Srcaddr>Specifies the source address to use (available on IPv6 only).
/4Specifies IPv4 used to ping. This parameter isn't required to identify the target host with an IPv4 address. It's only required to identify the target host by name.
/6Specifies IPv6 used to ping. This parameter isn't required to identify the target host with an IPv6 address. It's only required to identify the target host by name.
<targetname>Specifies the host name or IP address of the destination.
/?Displays help at the command prompt.

Linux

from the toybox, 0BSD

Check network connectivity by sending packets to a host and reporting its response. Send ICMP ECHO_REQUEST packets to ipv4 or ipv6 addresses and prints each echo it receives back, with round trip time. Returns true if host alive.

ping [OPTIONS] HOST
-4,-6 Force IPv4 or IPv6
-c CNTSend CNT many packets (default 3, 0 = infinite)
-fFlood (print . and \b to show drops, default -c 15 -i 0.2)
-i TIMEInterval between packets (default 1, need root for < .2)
-IIFACE/IP Source interface or address
-m MARKTag outgoing packets using SO_MARK
-qQuiet (stops after one returns true if host is alive)
-s SIZEData SIZE in bytes (default 56)
-t TTLSet Time To Live (number of hops)
-W SECSeconds to wait for response after last -c packet (default 3)
-w SECExit after this many seconds

Several platforms

from tldr-pages, CC BY 4.0

Send ICMP ECHO_REQUEST packets to network hosts.

Ping a host with IP 10.0.0.1 (Note: 10.0.0.1 can be shortened to 10.1)

ping 10.0.0.1Identify

Trips 2 Sigma rules: lowLinux Remote System Discovery by Alejandro Ortuno, oscd.community; informationalMacos Remote System Discovery by Alejandro Ortuno, oscd.community

Ping a host only a specific number of times

ping -c count hostIdentify
-cSend CNT many packets (default 3, 0 = infinite) toybox

Ping host, specifying the interval in seconds between requests (default is 1 second)

ping -i seconds hostIdentify
-iInterval between packets (default 1, need root for < .2) toybox

Ping host without trying to look up symbolic names for addresses

ping -n hostIdentify

Ping host and ring the bell when a packet is received (if your terminal supports it)

ping -a hostIdentify

Also display a message if no response was received

ping -O hostIdentify

Ping a host with specific count of pings, per-packet time to Wait for a response, and total wait time limit of the entire ping run

ping -c count -W seconds -w seconds hostIdentify
-cSend CNT many packets (default 3, 0 = infinite) toybox
-WSeconds to wait for response after last -c packet (default 3) toybox
-wExit after this many seconds toybox

Ping all IPv6 local network hosts

ping -6 ff02::1%eth0Identify

Send ICMP ECHO_REQUEST packets to network hosts.

Ping the specified host

ping "hostname"Identify

Ping a host a specific number of times

ping -c count "host"Identify
-cSend CNT many packets (default 3, 0 = infinite) toybox

Ping a host, specifying the interval in seconds between requests (default is 1 second)

ping -i seconds "host"Identify
-iInterval between packets (default 1, need root for < .2) toybox

Ping a host without trying to look up symbolic names for addresses

ping -n "host"Identify

Ping a host and ring the bell when a packet is received (if your terminal supports it)

ping -a "host"Identify

Ping a host and print the time a packet was received (this option is an Apple addition)

ping --apple-time "host"Identify

Windows

from tldr-pages, CC BY 4.0

Send ICMP ECHO_REQUEST packets to network hosts. Unlike Unix-like systems, Windows ping sends only 4 packets by default.

Ping a host 4 times

ping hostIdentify

Ping a host a specific number of times

ping -n count hostIdentify
-nSpecifies the number of echo Request messages be sent. Windows commands reference

Ping a host continuously (until stopped with <Ctrl c>)

ping -t hostIdentify
-tSpecifies ping continue sending echo Request messages to the destination until interrupted. Windows commands reference

Set the timeout in milliseconds to wait for each reply

ping -w milliseconds hostIdentify
-wSpecifies the amount of time, in milliseconds, to wait for the echo Reply message corresponding to a given echo Request message. Windows commands reference

Set the buffer size of the ping packet in bytes

ping -l bytes hostIdentify
-lSpecifies the length, in bytes, of the Data field in the echo Request messages. Windows commands reference

Ping a host using a specific source IP address

ping -S source_ip hostIdentify
-SSpecifies that the Internet timestamp option in the IP header is used to record the time of arrival for the echo Request message and corresponding echo Reply message for each hop. Windows commands reference

Resolve address to hostname

ping -a hostIdentify
-aSpecifies reverse name resolution be performed on the destination IP address. Windows commands reference

What detects it

Sigma process creation rules that name ping
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highPing Hex IPFlorian Roth (Nextron Systems)
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumObfuscated IP Via CLINasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
lowLinux Remote System DiscoveryAlejandro Ortuno, oscd.community
informationalMacos Remote System DiscoveryAlejandro Ortuno, oscd.community