ping and traceroute speak ICMP. Cloudflare Workers run inside a V8 isolate: no raw sockets, no way to emit ICMP packets — so a real ping needs an ordinary VPS to do it. Our Worker forwards the request to a probe, the probe runs ping / traceroute locally and sends the results back.

Without a probe, Ping falls back to measuring a TCP handshake from the Cloudflare edge — real, but not equivalent: it times the connect to port 443 or 80, has no TTL, and reveals no path. Such results are labelled TCP.

The probe accepts only public unicast targets and only runs ping and traceroute; private and reserved addresses are refused. Every request has a hard deadline — on timeout it returns whatever it already has instead of hanging.