ICMP

The Internet Control Message Protocol (ICMP) (RFC 792) is used by hosts and routers to exchange network-layer control and error information.

ICMP is primarily used for error reporting.

Example:

• a router cannot find a route to the destination network
• the router sends an ICMP error message such as "Destination network unreachable" back to the sender

ICMP and IP

Although ICMP is often considered part of IP, it architecturally lies just above IP:

• ICMP messages are carried inside IP datagrams
• they are transported as the payload of an IP datagram, just like TCP or UDP segments

Structure of an ICMP message

Internet Control Message Protocol (ICMP)
Offsets (starting positions)	Octet	0	1	2	3
Octet	Bit	0-7	8-15	16-23	24-31
0	0	Type	Code	Checksum
4+	32+	Content

Every ICMP message includes:

• a type field
• a code field

ICMP error messages (such as Destination Unreachable, Time Exceeded, or Redirect) additionally include the IP header and the first 8 bytes of the datagram that caused the error.

This allows the sender to identify which datagram triggered the ICMP message.

Ping

The ping utility uses ICMP to test connectivity:

1. the sender transmits an ICMP "Echo Request" (Type 8, Code 0)
2. the destination host responds with an ICMP "Echo Reply" (Type 0, Code 0)

Traceroute

traceroute uses ICMP messages to discover the routers between a source and a destination.

It sends a series of UDP probes and relies on ICMP error messages returned by routers and the destination host.

Each probe:

• is an IP datagram carrying a UDP segment with an unlikely destination port number
• has a progressively larger Time To Live (TTL) value:
  • first: TTL = 1
  • second: TTL = 2
  • third: TTL = 3
  • and so on

The source also starts a timer for each probe.

At each router:

• the router decrements the TTL by one
• if the TTL becomes 0:
  • the router discards the probe
  • the router sends an ICMP "Time Exceeded" message (Type 11, Code 0) back to the sender

When this ICMP message arrives back at the source:

1. the source calculates the round-trip time using the timer
2. the source retrieves the IP address (and, if available, the hostname) of the router from the ICMP message

How does the source know when to stop?

• the source keeps increasing the TTL until one probe reaches the destination
• because the probe contains a UDP segment sent to an unlikely port:
  • the destination host cannot deliver it to an application
  • it sends back an ICMP "Port Unreachable" message (Type 3, Code 3)
• when the source host receives this message, it knows the destination has been reached and stops sending additional probes

Traceroute discovers:

• every router between the source and destination
• each router's IP address (and often its name)
• the round-trip time to each router

Limitations and missing replies:

Some routers do not respond to ICMP messages used by traceroute, either for security reasons or to reduce control-plane load.

* * * in traceroute output indicates that no ICMP reply was received before timeout, not necessarily packet loss.

Modern tools like mtr improve on traceroute.

ICMP for IPv6

IPv6 uses ICMPv6 (RFC 4443):

• it reorganizes the ICMP type and code definitions
• it introduces new message types required for IPv6:
  • "Packet Too Big"
  • "Unrecognized IPv6 Options"