ICMP and TCP Ping

There’s more than one way to ask a host “are you there?”. Ping offers two.

ICMP echo

The classic ping, the one ping in Terminal sends. It’s a tiny message the host’s system answers itself, no service needed. That makes it the purest measure of the network, but:

• many servers, firewalls and some networks block it, so a host can look down while it’s working fine;
• routers on the way may treat it as low priority.

Traceroute and MTR use ICMP, because the routers’ replies to it are how a route is found.

TCP connect

Netutilus’s default: it times how long it takes to open a connection to a port, 443 unless you pick another, and closes it at once. Every web server answers on 443, so this works where ICMP is blocked, and it measures what an app’s connection actually goes through.

• If the host answers that nothing listens on the port, the probe counts as lost, labelled Connection refused. The host is up, but that port isn’t the one to time.
• A connection takes a little more work than an echo, so times can be a millisecond or two higher.

Which to use

• TCP for websites and servers you connect to, and anywhere ICMP is blocked.
• ICMP for routers, devices at home, and comparing with tools that use it.

If one mode times out and the other answers, the host is up: something blocks the first.

Related

• Ping and Ports.
• Uptime Monitor offers both as check types.