This is a follow up on Why Doesn't Ping Show RTT?
I had a look at BSD, Linux and BusyBox ping implementations. All three share the feature that they calculate the round trip time by sending a timestamp as echo request, receive it back as echo reply and then subtract the received timestamp from the current time.
Obviously the target host could modify the timestamp before it echoes it back, giving weird ping output. In addition to that, icmp protocol specification does not talk about timestamps at all. It's just stored in the payload field. If you modify the size of the payload to be too small to store the timestamp, ping is unable to calculate the round trip time.
I already patched a ping implementation to save the timestamps and not to rely on the echo. It seems to work perfectly, but I'm unsure if I'm breaking anything (in real life scenarios, the patch totally obeys the standards).
My questions:
1) Do I break anything?
2) What reason could the designer of ping have had for implementing it in such a non-obvious way?
0 Answers