Internet Control Message Protocol (ICMP)

ICMP as an Internet Feedback Protocol

The Internet Protocol (IP) defines how datagrams are sent across the internet. It uses a "best-effort" delivery model, so IP itself does not confirm delivery or provide retransmission.

The IP layer forwards a datagram according to its address and route. It does not by itself notify the sender when a route is missing, a host is unavailable, or a packet exceeds an MTU. Delivery details and any retransmission remain the responsibility of higher-layer protocols.

The "best-effort" model has low overhead, but it needs a separate mechanism for error reporting and diagnostics. A router may lack a route, reject a packet owing to an MTU, or discard it after the TTL expires. ICMP reports these events.

This role is provided by ICMP (Internet Control Message Protocol). It carries operational information, errors, and diagnostic replies associated with IP. It lets network devices report problems and test the reachability of other hosts, while leaving reliability to higher layers. ICMP feedback is advisory and can be filtered by policy. Delivery of an ICMP message is not guaranteed either. A router may rate-limit these messages, and the protocol forbids generating an error in response to another ICMP error. The absence of an ICMP reply therefore does not by itself prove that the original packet failed.

How ICMP Works: A Message Carried in IP

ICMP is not a transport protocol like TCP or UDP and does not carry application data such as web pages or email. It works at the network layer, and an ICMP message is carried inside an IP packet.

In the IPv4 header, the 'Protocol' field has the value 1, indicating that the payload is an ICMP message. The receiver passes it to ICMP processing.

The Structure of an ICMP Message

Every ICMP message begins with fields shared by the relevant message format:

• Type (8 bits): Specifies the general category of the message (e.g., "Destination Unreachable").
• Code (8 bits): Provides more specific information about the message type (e.g., for "Destination Unreachable," a code of '1' means "Host Unreachable").
• Checksum (16 bits): An error-checking field, similar to the IP header checksum, to ensure the ICMP message itself was not corrupted in transit.
• Data/Payload: The content varies by message type. For error messages, the base ICMPv4 specification includes the header and the first 8 bytes of the original IP packet that caused the error. This lets the source associate the error with a transmission. The remaining header fields depend on the type and can include an Echo identifier and sequence number.

Category 1: ICMP Error-Reporting Messages

Routers or hosts generate these messages when an IP datagram cannot be delivered. They usually go to the packet source, subject to ICMP rules covering error messages, multicast, and broadcast traffic.

Type 3: Destination Unreachable

This is a basic error message. It means that a router or the destination host cannot deliver the packet. The 'Code' field provides the specific reason:

• Code 0: Network Unreachable. The router has no route to the destination network in its routing table.
• Code 1: Host Unreachable. The router can reach the destination network, but it cannot deliver the packet to the specific host, for example when the host is offline or not responding.
• Code 3: Port Unreachable. The packet reached the destination host, but the application identified by the TCP or UDP port is not running or listening for connections.
• Code 4: Fragmentation Needed and DF Set.The packet exceeds the next link's MTU, but the "Don't Fragment" (DF) flag forbids router fragmentation. The router drops the packet and sends this error, which can include the next-hop MTU.

Type 11: Time Exceeded

This message has the two uses described here. A router can generate type 11 for either a packet TTL event or a fragment-reassembly timer:

• Code 0: TTL Expired in Transit. The Time To Live (TTL) field in a packet's header has reached zero. A router has decremented it to 0 and discarded the packet. This limits routing loops and forms the basis of the traceroute utility.
• Code 1: Fragment Reassembly Time Exceeded. When a datagram has been fragmented, the destination host waits for all fragments. After the timer expires, it discards the received pieces and may send this error.

Category 2: ICMP Query Messages and the ping Utility

Query messages are sent by a host or network administrator to gather information or diagnose a problem. A common use is the ping utility.

Ping sends an Echo Request to the selected host and waits for a reply. In IPv4 it uses two ICMP message types. The request includes an identifier and sequence number that help associate a reply with a particular probe. A host or firewall may filter Echo messages, so a failed ping does not prove that every service on the path is unavailable.

• Type 8, Code 0: Echo Request. This message is sent to the destination host.
• Type 0, Code 0: Echo Reply.This is the destination host's response when it generates a reply and the packet returns to the sender.

Decoding a ping Output

The following block shows the format of a ping result:

• Reply from 192.0.2.10: In a real result, this identifies the address from which the reply returned. This block is illustrative and uses a documentation address.
• bytes=32: This shows the size of the ICMP payload sent in the echo request.
• time=11ms: This is the Round-Trip Time (RTT). It covers the Echo Request trip and the Echo Reply return, so it describes the delay of that probe. The result can vary with load and route.
• TTL=116: This is the remaining Time To Live value from the reply packet. It can roughly estimate router hops when the initial value is known. With an initial TTL of 128, the calculation is $128-116=12$ routers on the return path.
• Lost = 0: This shows the number and percentage of probes lost in this run. It does not describe every transmission on the network.

Mapping the Route: The traceroute Utility

While ping tells you if a host is reachable and how long the round trip takes, the traceroute (or tracert on Windows) utility tells you the path your packets take to get there. It shows you the IP address of every router along the way.

Traceroute is a diagnostic tool that changes the TTL field of IP packets and receives ICMP "Time Exceeded" errors. The exact method depends on the implementation. Classic Unix traceroute often uses UDP packets, while Windows tracert uses ICMP Echo packets. Missing output at one hop can reflect ICMP filtering or rate limiting, so it does not always indicate a forwarding failure.

How Traceroute Works

1. Sending the First Packet: Traceroute sends a packet towards the destination but sets its TTL to 1.
2. First Router's Response:The very first router on the path receives the packet, decrements the TTL from 1 to 0, and discards it. It then sends an ICMP "Time Exceeded" message back to the source. The source address of this ICMP message is the IP address of the first router! Traceroute records this address and the RTT.
3. Sending the Second Packet: Next, traceroute sends another packet to the same destination, but this time it sets the TTL to 2.
4. Second Router's Response:The first router receives this packet, decrements TTL to 1, and forwards it. The second router receives it, decrements TTL from 1 to 0, discards it, and sends back an ICMP "Time Exceeded" message. Now traceroute knows the IP address of the second router in the path.
5. Next TTL Values: The process continues with the TTL increased by one for each packet. The router that decrements the TTL to zero sends an ICMP error, allowing the tool to record its address.
6. Reaching the Destination:When the TTL is sufficient for delivery, the destination does not send a "Time Exceeded" message. In classic UDP mode it can return "Port Unreachable", since the tool uses an inactive destination port. ICMP mode ends with an Echo Reply. That response marks the end of the trace.

The Evolution: ICMPv6

ICMPv6 extends ICMP for IPv6 and uses protocol number 58. It supports error reporting and diagnostics such as ping and traceroute, along with messages required for IPv6 operation.

One of these functions is the Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages for neighbor address resolution, router and prefix discovery, and reachability. Multicast listener membership is handled by the separate MLD mechanism. NDP replaces ARP's local role in IPv6, while MLD is outside NDP. An ICMPv6 error includes as much of the invoking packet as fits within the IPv6 minimum MTU, and types below 128 are errors while types from 128 are informational.