ICMP Echo Request Ping (-PE)

The ICMP echo request ping sends an ICMP echo request to nmap's destination IP address. This is the same type of ICMP echo request that is sent in the default ICMP echo request and TCP ACK ping combination. With the –PE option, the ICMP echo request can be specified as the nmap ping method without pairing it with the TCP ACK ping.

clock
The -PI option is an undocumented alias for the ICMP echo request ping.



ICMP Echo Request Ping Operation
This ping method consists of a single ICMP echo request frame. If an ICMP echo reply frame is received in return, the station is active:

PE_ping 

Source        Destination   Summary 
--------------------------------------------------------------------------------------
[192.168.0.5] [192.168.0.3] ICMP: Echo
[192.168.0.3] [192.168.0.5] ICMP: Echo reply
If a response is not received to the ICMP echo request, the IP address is not active or the connection to the remote device is filtered.


Advantages of the ICMP Echo Request Ping
An ICMP echo request is a simple and very common method of determining a station's availability. Many network administrators use this method to determine station availability through the aptly named "ping" command.

If ICMP traffic isn't filtered between the nmap station and the destination device, the entire network connection between the two stations may have very little filtering. It's very common for ICMP to be filtered through firewalls or packet filters, so a response to an ICMP echo request would be indicative of a link that has very little (if any) filtering.

The ICMP echo doesn't rely on any particular application or open port to work. If a remote device communicates via TCP/IP, then it's most often a candidate for the ICMP echo request ping.


Disadvantages of the ICMP Echo Request Ping
As mentioned above, ICMP is one of the most filtered protocols in enterprise networks. The ICMP protocol has the ability to redirect traffic, identify available workstations, and identify closed ports on a device. When a firewall or packet filter is installed, one of the first rules is the restriction of ICMP.


When to use the ICMP Echo Request Ping
If an nmap scan runs within a local network, then ICMP will probably be a successful ping method. As long as the network link is unfiltered, an ICMP echo request is a very reliable determination of station availability. If there's any doubt regarding the free flow of packets between the nmap scanning station and the remote device, a different or additional nmap ping type should be specified.