A ping of death is a denial-of-service attack that sends an improperly large, often fragmented ICMP echo request to exploit a flaw in how a receiving system validates or reassembles packets. The defect is in the receiver’s packet handling—not in the ordinary purpose of ping. The name is now considered deprecated terminology; the IETF glossary recommends a mechanism-specific description such as “ping packet overflow attack.”
What does “ping of death” mean?
In its Internet Security Glossary, the Internet Engineering Task Force (IETF) defines a ping-of-death attack as an improperly large ICMP echo request intended to make the destination fail. In plain terms, an attacker exploits a packet-processing bug so that the receiving computer or network device may crash or otherwise stop working properly.
As an Amazon Associate I earn from qualifying purchases.
ICMP echo requests are the messages commonly used by the ping utility to check whether another host responds. A correctly handled echo request is not inherently dangerous. The classic attack depended on a receiver mishandling malformed packet data.
How did the classic IPv4 attack work?
IPv4 stores a datagram’s total length in a 16-bit field, which allows a maximum datagram size of 65,535 bytes. That figure includes the IPv4 header; it is not a recommended ICMP payload size. The IETF discusses this limit in RFC 4732 (2006) and RFC 6274 (2011).
#1 Best Overall
When a packet is too large for a network link’s maximum transmission unit, IPv4 can carry it as fragments. The destination is expected to reassemble those fragments into the original datagram. In the historic ping-of-death case, the fragments’ combined extent exceeded the IPv4 maximum, and vulnerable systems mishandled the reassembly. The result could be a crash or system failure.
So the attack was not simply a normal, very large ping. Its harmful condition was an oversized or malformed reconstructed packet reaching an implementation with a packet-validation or reassembly flaw.
How is it different from an ordinary ping or a ping flood?
| Traffic or attack | What happens | What causes the problem |
|---|---|---|
| Ordinary ping | A host sends an ICMP echo request and may receive an echo reply. | It is a routine connectivity check when handled correctly. |
| Ping of death | In the classic IPv4 form, fragments of one echo request create an oversized reconstructed datagram. | A receiver’s flawed packet validation or reassembly may fail. |
| Ping flood | A target receives a high volume of echo requests or other traffic. | The volume can consume bandwidth or system resources; this differs from the classic malformed-packet mechanism. |
RFC 4732 describes the historic ping-of-death exploit as a single fragmented ICMP echo request. The key distinction is the mechanism: a ping flood relies on traffic volume, while a ping of death relies on a receiver mishandling an oversized packet.
When did the attack become known?
The IETF’s RFC 4732 says the exploit became widely known in 1996. It describes vulnerable systems crashing after receiving a single fragmented ICMP echo request whose fragments totaled more than the 65,535 bytes allowed in an IPv4 packet. The RFC also points to CERT Advisory CA-1996-26, “Denial-of-Service Attack via ping,” dated December 1996.
Is the ping of death still a threat?
The ping of death is best understood as a historic implementation vulnerability, not as evidence that any particular current device is exposed. Exposure depends on the packet-processing code in the systems involved. The sources cited here do not establish that every modern device is immune, nor do they provide a current prevalence or incident count.
Sound defenses include consistent packet-length validation, safe fragment reassembly, and maintaining and patching network software. RFC 6274 discusses dropping packets that fail length-consistency checks, and RFC 4732 notes that code affected by a discovered flaw can be patched. A specific product’s status should be checked against its vendor’s security information.
Rank #4
Why is the term sometimes avoided?
The IETF’s RFC 4949 glossary marks “ping of death” as deprecated terminology and recommends a mechanism-specific phrase such as “ping packet overflow attack.” The more precise wording helps distinguish this malformed-packet exploit from an ordinary ping or a high-volume flood.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Best Value
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
