Various application layer protocols listen on specific ports. For example, when you want to visit a website, the HTTP request that exits your computer is destined for TCP port 80 on the remote server. The source port on your computer is an arbitrary ephemeral port. The request is processed on the server, and data returns to your computer destined to the previous source port where your web browser (probably Chrome) is ready and waiting.
What about ICMP? How are individual ping attempts within the same request or simultaneous ping requests by concurrent users kept straight? Unlike higher level protocols such as HTTP, which uses TCP to match up segments, ICMP uses the identifier field to determine which running process should receive incoming replies. All pings originating from the same strike of the ENTER key use the same identifier value, which is incremented for subsequent ping requests. Issuing a ping causes five ICMP requests by default, and each request increments the value of the sequence number field to match each reply with its request.
Both the identifier and sequence number fields are 2 bytes each. A sample Echo request and Echo reply header is below:
