What two ICMP message types make up a ping, and why does the payload contain seemingly random ASCII characters?
Type 8 = Echo Request (sent by you), Type 0 = Echo Reply (sent back). The payload is filler bytes used to test the round-trip — Windows ping defaults to abcdefghijklmnop...
The exchange:
You → Target: ICMP Type 8 (Echo Request) | payload: "abcd...abcd"
You ← Target: ICMP Type 0 (Echo Reply) | payload: "abcd...abcd" (echoed)
Why a payload at all:
- Size testing —
ping -l 1500lets you test how big a packet can be before fragmentation - Identification — Reply must echo the same payload, proving the reply matches your request
- Sequence/ID matching — ICMP also has a Sequence Number and Identifier in the header
Why specifically abcdefghijklmnop:
Windows default. Linux uses a timestamp + filler pattern. The bytes themselves are arbitrary — they just need to be deterministic so the responder can echo them back exactly.
Spotting trouble:
If the reply payload differs from the request, something corrupted the packet en route. Wireshark will show this in the ICMP detail pane.
Larger pings:
ping -l 33 [target] # Windows: 33-byte payload
ping -s 33 [target] # Linux: same
This example specifically uses -l 33 to show how the visible payload changes when you add real data on top of the default header.
Tip: Try ping -f -l 1472 to test the maximum un-fragmented packet size. 1472 + 28 bytes (IP+ICMP header) = 1500 bytes = standard Ethernet MTU.
Go deeper:
Ping (networking utility) (Wikipedia) — how ping builds on ICMP Echo Request/Reply and what the payload bytes are for.- RFC 792 — ICMP — the spec defining Type 8 Echo and Type 0 Echo Reply and the data field.