Question

（a）What does it change if you change the size of the requests using the –s<size> option for ping command in Linux? Which is the minimum size that allows ping to measure and report the “time” field? Why this is happening?

(b)  Does the traceroute always return the same number if hops from a particular source to a specific destination? Please elaborate the answer.

Answer 1

a) It changes the size of additional data sent along with the ICMP packet. It is 56 by default on Linux meaning 56 bytes of additional data is sent in addition to mandatory ICMP header. Linux ping measures RTT(time) by sending ICMP echo packet with time field in the additional data and subtacting it from current time on receiving the ICMP echo reply back. It happens that size of struct timeval, the struct that Linux uses for timekeeping is 16 bytes. So, minimum value for s is 24 to report the time field.

b) No, that needn't be the case. It can be the case some router on the path failed resulting in the packets traveling to the destination taking an alternative longer route which results in a greater number of hops.