Now that we've seen ping working, let's explore the packets in greater depth.
First, the echo‑request message.
Some of the information in the blue highlighted bar is
unsurprising, such as the source and destination IP
addresses and protocol name of ICMP.
The more interesting guts are towards the bottom.
First, observe the Type/Code construct.
I like to think of these values as coarse and fine‑tuning
knobs, respectively, to identify an ICMP packet.
The type is a major classifier for the packet type, and in
this case, type 8 is an echo‑request.
Not all types have codes, which represent finer
differences in packet classification.
When we talk about ICMP unreachables,
we will see more variety here, but for ping messages, the only code is 0
since echo‑requests don't have any funky varieties.
The identifier is often used by operating systems to identify the
process or daemon that originated the traffic.
Suppose you and I were both logged into the client together.
We would each have our own shell process so if we pinged the
remote server at the same time, our identifiers would be different.
This is how the operating system marries up replies to
their original requests at a process level.
The sequence number serves a similar purpose as the
identifier except that it marries up replies to their
original request at a packet level.
Once the identifier is matched to specify the process that originated
the echo‑request, the sequence number measures which exact
echo‑requests received the replies and which did not.
Some networks may deliver packets out of order, which
is why this field is important.
I need to briefly mention what this BE/LE monkey business is all
about. BE and LE refer to the endianess of a machine,
BE meaning big‑endian and LE meaning little‑endian. Endianess is the
order in which bytes are stored in the CPU. Big‑endian stores more
significant bytes first, that is, to the left.
Little‑endian stores the most significant bytes last to the right.
This is not specific to ICMP, but different CPU hardware may use
different formats. If you are on a source big‑endian system that reports
and identifier of 5 and the target little‑endian system debugs show that
the identifier is 1280, then these numbers are actually the same. Network
byte order uses big‑endian.
The little‑endian value is for information only. And
honestly, don't become overly concerned about it. I wanted to touch on it for completeness.