How does macOS allow Standard users to ping
Let's take a look at the source code for Apple's ping implementation. Notably, we see this:

if (getuid())
    s = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
else
    s = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
sockerrno = errno;


getuid returns 0 if root. So this code is saying, "open the socket in DGRAM (datagram mode) if we are not root. If we are root, open as raw".

So a raw socket is only used when you are root. An IMCP ping packet is a standard DGRAM packet and does not require raw sockets.

However, there are some flags that can be passed to ping that do require root, and for those you will get an "Operation Not Permitted". For example:

&gt;ping -f
ping: -f flag: Operation not permitted


When run as root, I do not get the operation not permitted. So Apple's implementation will let you do standard ping operations which does not require root, but require you to run as root for certain flags and operations.

Depending on if you are root, it may set some additional socket options:

if (uid == 0)
    (void)setsockopt(s, SOL_SOCKET, SO_SNDBUF, (char *)&amp;hold,
        sizeof(hold));