Resolving Access Denied Errors with the ICMP Components

By default, the ICMP and Ping components send and receive ICMP messages using raw sockets. Most operating systems allow only privileged processes to create raw sockets, so when the application runs as a standard user, the component fails with an access denied error (e.g., Winsock error 10013, "An attempt was made to access a socket in a way forbidden by its access permissions").

Windows

On Windows, raw sockets can only be used by applications that run with administrator privileges. To send ping requests without administrator privileges, set the UseIPHLPDLL configuration setting to true. The component then uses the ping functions of the Windows IP Helper API (iphlpapi.dll) instead of raw sockets, which supports both IPv4 and IPv6.

Ping ping = new Ping();
ping.Config("UseIPHLPDLL=true");
ping.PingHost("www.example.com");
Console.WriteLine("Reply in " + ping.ResponseTime + " ms.");

The UseICMPDLL configuration setting works in the same way, but uses the legacy icmp.dll library, and does not support IPv6. For new applications, UseIPHLPDLL is recommended.

Note the following when using these settings:

• The IP Helper API can only send ICMP echo requests and receive the corresponding replies. It is therefore suitable for the Ping and TraceRoute components, and for sending echo requests with the ICMP component. To send or receive other types of ICMP messages, the ICMP component must use raw sockets, and the application must run with administrator privileges.
• In the .NET edition, the TraceRoute component uses icmp.dll by default on Windows Vista and later, so it does not require administrator privileges.

Linux and macOS

On Linux and macOS, raw sockets can only be created by the root user, or (on Linux) by a process that has the CAP_NET_RAW capability. The UseIPHLPDLL and UseICMPDLL configuration settings are available only on Windows.

To run the application without root privileges on Linux, grant the capability to the executable of the application:

sudo setcap cap_net_raw+ep /path/to/application

Note that older versions of Windows (Windows NT and Windows 2000) required a registry change (the DisableRawSecurity value) to allow standard users to create raw sockets. This is not supported on current versions of Windows, which require administrator privileges or the UseIPHLPDLL configuration setting instead.

Note that in older versions, the ICMP component was named ICMPPort.