ICMP
The Internet Control Message Protocol (ICMP) is the error-reporting and diagnostic companion to IPv4, defined in RFC 792 (September 1981). ICMP messages travel inside ordinary IP datagrams, but ICMP is considered an integral part of the IP layer rather than a transport protocol — gateways and hosts use it to report delivery problems back to the source. ICMP messages are never generated in response to other ICMP messages (a rule that prevents error loops), nor in response to broadcast/multicast traffic or non-first fragments.
Message format
Every ICMP message begins with the same three fields: Type (8 bits), Code (8 bits, refining the type), and Checksum (16 bits, one’s-complement sum over the ICMP message). Error messages (Destination Unreachable, Time Exceeded, Parameter Problem, Source Quench, Redirect) then carry the IP header plus the first 64 bits of the original datagram, so the source can match the error to the process that sent it — the original destination port lives in those first 64 bits for TCP/UDP.
Core message types from RFC 792:
| Type | Message | Notes |
|---|---|---|
| 0 | Echo Reply | Response to Echo; payload returned verbatim |
| 3 | Destination Unreachable | Codes: net / host / protocol / port unreachable, fragmentation-needed-but-DF-set, source-route failed |
| 4 | Source Quench | Congestion control (now deprecated by RFC 6633) |
| 5 | Redirect | Tells a host a better first-hop gateway |
| 8 | Echo | The “ping request” — may carry arbitrary data, which the reply echoes back |
| 11 | Time Exceeded | Code 0 = TTL expired in transit; code 1 = fragment reassembly timeout |
| 12 | Parameter Problem | Pointer identifies the offending octet in the original header |
| 13/14 | Timestamp / Timestamp Reply | Milliseconds since midnight UT |
| 15/16 | Information Request / Reply | Obsolete; deprecated by RFC 6918 |
The authoritative, living registry of types and codes is maintained by IANA.
Operational relevance
- ping is a thin wrapper around Echo (type 8) / Echo Reply (type 0) pairs.
- traceroute works by eliciting Time Exceeded (type 11) messages from each successive hop as the TTL increments.
- Type 3 code 4 (fragmentation needed, DF set) is the signal behind Path MTU Discovery — filtering it breaks connections in hard-to-debug ways, which is why blanket ICMP filtering causes mysterious hangs.
- Scanning side effects: a closed UDP port typically triggers a type 3 code 3 (port unreachable), which is what makes nmap UDP scanning slow and ambiguous; rate-limited or filtered ICMP makes closed and open ports indistinguishable.
- Because ICMP is unauthenticated, Redirect (type 5) and spoofed unreachable messages were historically used for traffic redirection and DoS — one reason many networks filter aggressively at the edge.
Sources
- RFC 792 — Internet Control Message Protocol
- IANA — Internet Control Message Protocol (ICMP) Parameters
- Internet Control Message Protocol — Wikipedia
Related
- ping-command — the user-facing ICMP echo tool, with its cross-platform flag traps
- udp — port-unreachable behavior and UDP scanning ambiguity
- nmap — host discovery and scan interpretation in the face of filtered ICMP