One thing I never knew about ping is that if you ping a broadcast address, then all hosts will respond! But for some operating systems (windows I think?), you need a packet capture to see this. It's been useful when probing around unknown networks.

I only found that out by reading the source code. It was part of a short-lived attempt to become a better hacker by familiarizing myself with the Linux source code, kernel and all. The more I learn, the more impossible it seems to ever master it all...