What port does ping work over?

A trick question, to be sure, but an important one. If he starts throwing out port numbers you may want to immediately move to the next candidate. Hint: ICMP is a layer 3 protocol (it doesn’t work over a port) A good variation of this question is to ask whether ping uses TCP or UDP. An answer of either is a fail, as those are layer 4 protocols.

• How does ping work

Ping works at the application layer of the tcp ip model.
Ping does not use tcp ip transport layer protocols like TCP or UDP.
It uses the network layer protocol ICMP.
So Ping does not have a TCP or UDP header

• ICMP port and transport layer port:

When an application uses, the transport layer, it is addressed by a port number.  The source and destination both have a port number along with the IP addresses. When an application over the transport layer sends a request to the peer, it sends a message with source and destination port numbers. On reply or response, the port number becomes the opposite.  Based on the port number the transport layer delivers the message to the correct application.

To understand the correlation between request and response without a port we need to first understand the ICMP echo and echo reply message as per RFC 792.

Here we see that there is an identifier.  This is used similarly to port numbers in the transport layer.

This is two bytes filed, the IP header knows the identifier and delivers the response to the ping application that is using the identifier in the IP header response

https://www.cspsprotocol.com/what-is-icmp-port-number/

• ICMP is actually at the "top" of the layer 3. It uses the IP protocol to deliver data to a remote host. In other words, ICMP messages must be encapsulated in IP packets.

Consider it as similar to ARP which could be considered to be "at the top" of layer 2, while using the Ethernet protocol to actually send packets.

The ICMP header is at layer 4, just like TCP and UDP so people argue that it belongs in layer 4. Others however argue that ICMP is a layer 3 protocol, since it assists IP and has no concept of ports.

ICMP (and ICMPv6, IGMP, etc) all manage the Network Layer connections. They are not (typically) used by end users, but by the Operating System. For that reason, it belongs in Layer 3 (Network) even though it relies on IP for addressing and path determination (routing).

https://serverfault.com/questions/511965/why-is-icmp-categorized-as-a-layer-3-protocol

• 6. Why is it that an ICMP packet does not have source and destination port number?

Solution:

The ICMP packet does not have source and destination port numbers because it was designed to

communicate network-layer information between hosts and routers, not between application

layer processes. Each ICMP packet has a "Type" and a "Code". The Type/Code combination

identifies the specific message being received. Since the network software itself interprets all

ICMP messages, no port numbers are needed to direct the ICMP message to an application layer

proce

http://www.cs.toronto.edu/~ahchinaei/teaching/2016jan/csc358/Assignment4wSol.pdf

• Port numbers are a feature of transport layer protocols such as TCP and UDP. ICMP is really part of the internetworking layer (IP), so that attribute doesn't exist at that layer.

TCP and UDP are transport protocols that use port numbers to multiplex their use between applications or processes.

browser using HTTP over TCP can e.g. connect multiple times to the exact same web server. While the destination port is the same (default for HTTP: 80), different source ports are used for each socket connection.

ICMP is not a transport protocol but a part of the IP protocol. It is used for signaling between hosts. Messages that can be transmitted include

    Destination unreachable (a router signals that it's unable to forward towards the destination, a host rejects a packet, or similar)

    Redirect message (a router wants the source to use another gateway)

    Time exceeded (a packet has exceeded its lifetime/hop count and was dropped)

    Echo request / Echo reply (used by ping)

Port numbers are transport-layer addresses used by some transport protocols. The purpose of the transport addresses (ports) is to allow multiple processes to simultaneously use a transport protocol, and the transport protocol can deliver the correct data to the correct process out of multiple processes using it.

The port numbers are also per protocol. For example, TCP and UDP use port numbers for addressing, but TCP port 12345 is not UDP port 12345. Only one process at a time can bind to TCP port 12345, but one process can bind to TCP port 12345 at the same time another process binds to UDP port 12345

https://networkengineering.stackexchange.com/questions/50955/why-doesn-t-icmp-use-port-numbers