ICMP

Header

Type

Code

Checksum

Rest of Header

Messages

Notable control messages

Type	Code	Description
0 – Echo Reply	0	Echo reply (used to Ping)
1 and 2		Reserved
3 – Destination Unreachable	0	Destination network unreachable
	1	Destination host unreachable
	2	Destination protocol unreachable
	3	Destination port unreachable
	4	Fragmentation required, and DF flag set
	5	Source route failed
	6	Destination network unknown
	7	Destination host unknown
	8	Source host isolated
	9	Network administratively prohibited
	10	Host administratively prohibited
	11	Network unreachable for TOS
	12	Host unreachable for TOS
	13	Communication administratively prohibited
	14	Host Precedence Violation
	15	Precedence cutoff in effect
4 – Source Quench	0	Source quench (congestion control)
5 – Redirect Message	0	Redirect Datagram for the Network
	1	Redirect Datagram for the Host
	2	Redirect Datagram for the TOS & network
	3	Redirect Datagram for the TOS & host
6		Alternate Host Address
7		Reserved
8 – Echo Request	0	Echo request (used to ping)
9 – Router Advertisement	0	Router Advertisement
10 – Router Solicitation	0	Router discovery/selection/solicitation
11 – Time Exceeded	0	TTL expired in transit
	1	Fragment reassembly time exceeded
12 – Parameter Problem: Bad IP header	0	Pointer indicates the error
	1	Missing a required option
	2	Bad length
13 – Timestamp	0	Timestamp
14 – Timestamp Reply	0	Timestamp reply
15 – Information Request	0	Information Request
16 – Information Reply	0	Information Reply
17 – Address Mask Request	0	Address Mask Request
18 – Address Mask Reply	0	Address Mask Reply

Troubleshooting

• IP address is unconfigured:

Reply from 10.102.82.14: Destination host unreachable

• Ping disabled on host:

Request timed out

• Router performs ICMP rate limiting:

U.U.U ping response

Path MTU Discovery

• RFC 1191 defines path MTU discovery = process to detect smaller MTU to a destination
• Two key components:

Don't Fragment (DF) bit of the IP header
A subcode of the ICMP Destination Unreachable message - Fragmentation Needed

• Setting DF bit in IP packet prevents a Router from fragmenting a packet larger than MTU
• Packet is discarded and an ICMP Fragmentation Needed message is sent
• RFC 1191 expands the Fragmentation Needed message to include the MTU of the link requiring fragmentation
• Path MTU discovery is continuous process & can detect increase or decrease in MTU

tracepath -n 192.168.1.2
mturoute (Windows)

• A Fragmentation Needed message can be seen in packet #6 of this packet capture:

Path MTU PCAP

Traceroute

Source: Packetlife.net

• Works by sequentially incrementing the TTL of UDP (or ICMP on Windows) packets.
• All hops return a "TTL exceeded in transit" message
• Last hop should return a "destination unreachable/port unreachable" message
• UDP traceroute packets are sent to a pseudorandom high port on which the end host is not likely to be listening

Traceroute PCAP

{{#widget:DISQUS |id=networkm |uniqid=ICMP |url=https://aman.awiki.org/wiki/ICMP }}