Network layer (OSI layer 3)

This can be seen with Wireshark very clearly for example, just make a ping and disssemble it.

There is no userland process for it, it is handled directly by the Linux kernel: unix.stackexchange.com/questions/439801/what-linux-process-is-responsible-for-responding-to-pings/768739#768739