Why does ping not require administrative privileges on Windows?

Question

Possible duplicate:
Why does ping work without administrator privileges?

From the MSDN article of the TCP / IP Raw Sockets article:

... It is important to understand that some SOCK_RAW sockets can receive many unexpected datagrams. For example, a PING program can create a socket of type SOCK_RAW to send ICMP echo requests and receive responses ....

This passage assumes that you must use raw sockets on Windows platforms to perform ICMP ping. However, the same article also states:

Note. . To use a socket of type SOCK_RAW, administrative privileges are required. Users running Winsock applications that use raw sockets must be members of the Administrators group on the local computer, otherwise raw socket calls will fail with the WSAEACCES error code. On Windows Vista and later, raw sockets are accessed when creating sockets. In earlier versions of Windows, raw socket access is performed during other socket operations.

Of course, I do not need to be an administrator to ping other hosts. So ping.exe gets a special treatment, does it even use raw sockets or is there something else I am missing?

Answer 1

As Uwe said, ping just doesn't use raw sockets. It uses a specific API that sends pings called IcmpSendEcho , or IcmpSendEcho2 .

You can use Dependency Walker on c:\windows\system32\ping.exe to see it yourself.