Impacket ping.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”A small example that sends ICMP Echo requests using a raw IPv4 socket and Impacket’s packet structures.
| Item | Details |
|---|---|
| Implementation | examples/ping.py |
| Category | Packets / ICMP / capture |
| Size | 93 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”This older sample does not handle -h. Check its usage message and top-level sys.argv handling.
python examples/ping.py <src-ip> <dst-ip>src-ip: Source address set in the IPv4 header; also used to match the destination of replies.dst-ip: Destination for Echo Requests; also used to match the source of replies.- There are no additional options. With fewer than two arguments, it prints usage and exits with code 1.
Related technology: ImpactPacket in Packets / registry / ESE / NTFS.
Detailed processing flow
Section titled “Detailed processing flow”The script builds an IP/ICMP Echo packet for the destination, calculates its checksums, and sends it through a raw socket. It waits for a response with select, decodes the received buffer with IPDecoder, and displays the matching Echo Reply’s source, sequence, and round-trip time.
How it works
Section titled “How it works”Rather than calling the OS ping utility, this implementation assembles the IPv4
header, ICMP Echo Request, and payload as ImpactPacket objects. It sets the source
and destination in the IP header, sets the ICMP type and identifier, layers the
objects, calculates checksums, and sends the completed packet through a raw socket with IP_HDRINCL enabled.
Each loop increments the ICMP identifier and waits up to one second for a reply with select.
IPDecoder turns the received bytes back into an IPv4-to-ICMP hierarchy. The script checks
whether the source, destination, and ICMP type match the requested Echo Reply. This code
uses the identifier as a sequence counter rather than the sequence field.
A missing response does not prove that the host is down. ICMP filtering, routing, source-spoofing prevention, raw socket permissions, or target policy can suppress it. The script does not implement RTT statistics, packet-loss totals, or multiple outstanding requests. When extending it, match the identifier, sequence, and payload so unrelated ICMP packets are not counted as replies.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
| module-level entry | 1 | Parses arguments and runs at the top level |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | ImpactDecoder, ImpactPacket |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Performs network probing or live packet capture. Check the send and receive scope, interface, filters, and handling of captured data.
- Raw socket or packet capture privileges may be required. Captured data may include third-party traffic.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- Distinguish a missing input file, a damaged file, an incomplete read, and an unsupported format.
When changing the implementation
Section titled “When changing the implementation”The code depends on ImpactPacket, ImpactDecoder, and standard raw sockets. This positional-only sample does not use argparse. It normally needs raw socket privileges; do not weaken identifier or sequence matching.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/ping.py - CLI: Use a subprocess to check the usage message and exit code with no or too few arguments.
- No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.