ping: A Thousand Lines, One Evening, One Life

A December Evening

In December of nineteen eighty-three, in Aberdeen, Maryland, at a place called the United States Army Ballistic Research Laboratory, a twenty-five year old engineer named Mike Muuss noticed that the network was acting strangely. He could not log in to a machine he should have been able to log in to. The network was not answering. He did not know if the cables were bad, or the routers were bad, or the operating system on the other end had gotten confused. He had no good way to find out.

He had been at a DARPA meeting in Norway a few months earlier. While he was there, a man named Dave Mills had said something almost in passing. Mills had mentioned that you could measure the round trip latency of an internet connection by sending a small special packet, called an ICMP echo request, and timing how long it took to come back. The protocol was already defined. The packets were already supposed to be supported. Almost no software existed that used them.

[slow] Muuss remembered.

He sat down at his terminal. He started writing. The program he had in mind would open a special low level network socket, build an ICMP echo packet, send it to a remote machine, wait for the reply, and time the round trip. He wrote the code. He compiled it. It compiled cleanly. He ran it. It did not work, because the kernel he was running did not actually support raw ICMP sockets yet. So he wrote that too. He patched the kernel. He recompiled the kernel. He rebooted. He tried again. By morning, the program was working. The whole thing, including the kernel changes, was about a thousand lines of code.

He named it ping, after the sound a submarine's sonar makes when it pings the water and listens for the echo. The name was perfect. The metaphor was exact. The submarine sends a pulse. It listens. The echo comes back. The time between is the distance.

Some people, later, decided that ping must stand for something. Packet Internet Groper. Muuss heard this and was patient about it. The acronym is a backronym. He chose the name because of the sonar.

The Bug Was Already Fixed

The thing Muuss did not know, while he was writing ping that night, was that the network problem he was trying to debug had already been solved.

A colleague at the lab named Chuck Kennedy, who everyone called Kermit, had found a hardware fault somewhere in the cabling and fixed it. By the time Muuss had ping working, the network was answering normally. He could log in to the machine he had been trying to log in to. The thing he built ping for, in the strict sense, did not need ping to be solved. The network was fine.

Muuss kept ping anyway. He thought it might be useful again.

It was useful again. Within a year, ping had been included in the Berkeley Software Distribution, which meant it shipped with Unix on every machine that ran Unix. Within five years, ping was on every Unix system in the world. Within ten years, Microsoft Windows had its own version, with the same name, the same flags, and the same behavior. Today, ping is on every operating system that has a network. Every Mac. Every Linux server. Every router. Every phone. Every smart television. Every embedded device with an internet connection.

When you tap an icon on your phone and nothing happens, somewhere down the stack, in some technician's terminal, somebody is typing ping. They have been typing ping every day for forty-three years. They will keep typing ping for as long as there is an internet to ping.

How to Use It

You type ping. Then a space. Then the name of a machine, or its numeric address. Like this. Ping example dot com.

The program sends a small packet to that machine, every second, and prints a line every time the packet comes back. The line tells you how long the round trip took, in milliseconds. If the packet does not come back within a few seconds, the program tells you the packet was lost. You let it run for as long as you want. You press Control C to stop it. At the end, ping prints a summary. How many packets you sent. How many came back. The minimum, average, and maximum round trip time.

That is essentially the whole tool. There are flags for special cases. You can change how often packets are sent. You can change how big they are. You can ask for a fixed number and stop. You can use IP version six. The program is so small that you can read its source code in a single sitting.

What ping tells you is, at minimum, whether a remote machine is reachable. If your phone cannot load a website, you ping the website. If the ping works, the network is fine and the website is broken. If the ping does not work, the network is the problem. This single distinction has saved more troubleshooting hours, across every internet user since nineteen eighty-three, than almost any other tool on the planet.

The numbers ping returns are also informative. A round trip time of one millisecond means you are pinging something on the same local network. Twenty milliseconds means a server in the same city. One hundred milliseconds means somewhere on the other side of a continent. Three hundred milliseconds means somewhere on the other side of the world, going through fiber optic cables and undersea repeaters and the patient work of a few thousand network engineers. Eight hundred milliseconds means a satellite. The number is a measurement of distance, in light through glass.

The Quote and the Crash

Muuss kept working at the same lab for the rest of his life. The Ballistic Research Laboratory was renamed and folded into other organizations several times. He stayed. He worked on a three dimensional solid modeling system called BRL CAD, which the military used to model tanks and helicopters and missiles, and which is still used today. He worked on a network throughput tool called ttcp. He won a Usenix lifetime achievement award in nineteen ninety-three. He never moved to the private sector. He never started a company. He stayed at the lab.

In an interview late in his life, talking about ping, he said something that has been quoted many times since.

If I'd known it was going to be my legacy.

The full sentence continued, with the suggestion that if he had known how long it would last, he would have spent another day or two on it. He would have added a few more options. He would have polished it more. He could not have known. Nobody, in nineteen eighty-three, could have known what was about to happen to the internet. He wrote ping in one evening because the network was acting up and he wanted to know what was wrong. He shipped it. He moved on.

On the twentieth of November, two thousand, Mike Muuss was killed in a car accident. He was forty-two. The Ballistic Research Laboratory put up a memorial page on its website. Many of the people who had known him wrote tributes. The internet, which by that point had become the thing it would become, paused briefly and acknowledged him, and then went on with what it was doing.

It is now twenty-five years since Muuss died. The Ballistic Research Laboratory, in the form he worked at, is gone. The PDP eleven he wrote ping on is gone. The Berkeley Software Distribution, in its original form, is gone. The DARPA meeting in Norway, where Dave Mills mentioned ICMP echo packets in passing, is unrecoverably in the past.

[slow] Ping is still running.

Right now, on every continent, in every data center, on every laptop, hundreds of millions of times per minute, the program runs. The packet goes out. The packet comes back. The number gets printed. The submarine listens for the echo. The man who wrote the program in one December evening, between dinner and sunrise, when he was twenty-five and the network was acting up, has been gone for a quarter of a century.

The echo keeps coming back.