Course: COMP347 Computer Networks (Revision 10) | Textbook: Kurose & Ross, Computer Networking: A Top‑Down Approach (9th ed.)
Upon completion of this tutorial, students should be able to:
The Internet Control Message Protocol (ICMP) is an essential part of the Internet Protocol suite, operating at the network layer. Its primary purpose is to provide error reporting and diagnostic functions for IP. Unlike transport protocols like TCP or UDP, ICMP is not used to carry user data; instead, it carries control messages between hosts and routers. ICMP messages are encapsulated in IP datagrams (using protocol number 1).
ICMP is used for a variety of tasks: reporting errors (e.g., destination unreachable, time exceeded), performing diagnostics (ping, traceroute), and helping with network management (redirects, router discovery). This tutorial covers the ICMP architecture, message formats, common types and codes, and the operation of ping and traceroute. We also discuss ICMP security issues and best practices, as well as ICMPv6.
ICMP is defined in RFC 792. It is a control protocol that provides feedback about problems in the network environment. ICMP messages are generated by routers or hosts to report errors or to assist in troubleshooting. They are not transported like user data; they are encapsulated directly in IP datagrams.
ICMP operates as a companion to IP, but it is not a higher‑layer protocol; it is considered part of the network layer. ICMP messages are usually generated in response to IP datagrams that have encountered problems, but they can also be sent as standalone queries (e.g., Echo Request).
All ICMP messages begin with a common header:
The checksum covers the entire ICMP message (header + data). It uses the same one's complement algorithm as IP.
| Type | Code | Description |
|---|---|---|
| 0 | 0 | Echo Reply (ping reply) |
| 3 | 0 | Destination Unreachable: Net Unreachable |
| 3 | 1 | Destination Unreachable: Host Unreachable |
| 3 | 2 | Destination Unreachable: Protocol Unreachable |
| 3 | 3 | Destination Unreachable: Port Unreachable |
| 3 | 4 | Destination Unreachable: Fragmentation Needed but DF Set (PMTUD) |
| 3 | 6 | Destination Unreachable: Network Unknown |
| 3 | 7 | Destination Unreachable: Host Unknown |
| 3 | 13 | Destination Unreachable: Administratively Prohibited |
| 4 | 0 | Source Quench (deprecated) |
| 5 | 0 | Redirect: Redirect for Network |
| 5 | 1 | Redirect: Redirect for Host |
| 5 | 2 | Redirect: Redirect for Type of Service and Network |
| 5 | 3 | Redirect: Redirect for Type of Service and Host |
| 8 | 0 | Echo Request (ping) |
| 9 | 0 | Router Advertisement |
| 10 | 0 | Router Solicitation |
| 11 | 0 | Time Exceeded: TTL expired in transit |
| 11 | 1 | Time Exceeded: Fragment reassembly timeout |
| 12 | 0 | Parameter Problem: Pointer indicates error |
| 12 | 1 | Parameter Problem: Missing required option |
| 12 | 2 | Parameter Problem: Bad length |
ICMP error messages are sent when a router or host cannot process a datagram.
In error messages, the payload includes the IP header and the first 8 bytes (or more) of the original datagram that caused the error, so the sender can identify the offending packet.
Ping uses ICMP Echo Request (Type 8) and Echo Reply (Type 0). A host sends an Echo Request to a destination; if the destination is reachable, it responds with an Echo Reply. The ping utility measures round‑trip time and packet loss, providing a basic connectivity test.
Ping is widely used for troubleshooting network connectivity, but it can be blocked by firewalls for security reasons.
Traceroute is a diagnostic tool that maps the path from a source to a destination. It exploits ICMP Time Exceeded messages. The source sends a series of packets with increasing TTL values (starting at 1). Each router along the path decrements the TTL; when TTL reaches 0, the router discards the packet and sends an ICMP Time Exceeded (type 11) back to the source. The source records the source IP of each ICMP message, revealing the router's address. The process continues until the destination is reached (usually by using a UDP packet to a high port, triggering an ICMP Port Unreachable from the destination, or using ICMP Echo Request with TTL large enough).
There are variations: some implementations use UDP packets (traceroute on Linux typically uses UDP), while others use ICMP Echo Requests (Windows tracert). Both rely on ICMP Time Exceeded and Port Unreachable.
ICMP can be abused in various attacks:
Best practices: Many organizations block incoming ICMP Echo Requests at the perimeter to hide hosts and prevent attacks. However, this can break Path MTU Discovery and other diagnostics. It is recommended to allow ICMP messages that are essential (e.g., Destination Unreachable, Time Exceeded for PMTUD) and rate‑limit others.
ICMPv6 (RFC 4443): ICMP for IPv6. It has a similar structure but with additional types: Neighbor Discovery (NDP) messages (Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement) are part of ICMPv6. ICMPv6 also includes Packet Too Big messages for Path MTU Discovery.
Path MTU Discovery (PMTUD): ICMP plays a crucial role in PMTUD. When a router needs to fragment a datagram but the DF flag is set, it sends an ICMP Destination Unreachable (type 3, code 4) message back to the source, indicating the MTU of the next hop. The source can then adjust its packet size.
Q1. What is the protocol number for ICMP in the IP header?
A) 1
Q2. Which ICMP type is used for Echo Reply?
A) 0
Q3. An ICMP Destination Unreachable message is sent when:
B) A datagram cannot be delivered
Q4. Which ICMP type is used for Time Exceeded?
B) 11
Q5. The ping utility uses which ICMP message types?
A) Echo Request (8) and Echo Reply (0)
Q6. Traceroute primarily uses which ICMP message type to discover routers?
C) Time Exceeded (Type 11)
Q7. Which ICMP code indicates "Fragmentation Needed but DF Set" (PMTUD)?
D) Code 4 (Destination Unreachable, type 3, code 4)
Q8. ICMP messages are encapsulated in:
C) IP datagrams
Q9. The ICMP checksum covers:
B) The entire ICMP message
Q10. Which ICMP message type is used to inform a host of a better route?
C) Redirect (Type 5)
Q11. Which of the following is NOT a valid ICMP Destination Unreachable code?
D) TTL Expired is Time Exceeded (Type 11).
Q12. In an ICMP error message, the payload typically includes:
B) The IP header plus at least the first 8 bytes of the original payload
Q13. ICMPv6 is defined in:
B) RFC 4443
Q14. Which ICMP message is deprecated and should not be used?
B) Source Quench (Type 4)
Q15. The Smurf attack exploits which ICMP feature?
A) Echo Request to a broadcast address with spoofed source.
Q16. In ICMP, the 'Type' field is how many bits?
B) 8
Q17. Which ICMP type is used for Router Advertisement?
A) 9
Q18. The purpose of ICMP Parameter Problem (Type 12) is:
B) To report an error in the IP header
Q19. Which of the following is a common defense against ICMP attacks?
D) Both A and B (but blocking all can break PMTUD; selective filtering is better).
Q20. In IPv6, which ICMPv6 message is used for Path MTU Discovery?
A) Packet Too Big (ICMPv6 type 2).
Q21. Traceroute on Windows (tracert) typically uses:
B) ICMP Echo Requests with increasing TTL.
Q22. ICMP Redirect messages are typically sent by:
C) A router
Q23. Which ICMP type is used for Echo Request?
B) 8
Q24. The ICMP "Port Unreachable" message is used by:
B) UDP (it is sent by a host when a UDP datagram arrives for a port with no listener; also used by traceroute when using UDP).
Q25. Which of the following is NOT a function of ICMP?
C) Routing of user data (that is IP's job).
Q26. In ICMP, the checksum is calculated over the ICMP message using:
B) One's complement sum (same as IP checksum).
Q27. ICMP Time Exceeded (code 1) indicates:
B) Fragment reassembly timeout (code 0 is TTL expired).
Q28. The 'Ping of Death' attack involved:
B) Sending oversized ICMP packets that exceeded the maximum size.
Q29. Which ICMP message is used by routers to solicit configuration from a DHCP server?
D) None of the above – DHCP uses UDP, not ICMP.
Q30. ICMPv6 Neighbor Discovery (NDP) replaces which IPv4 protocol?
A) ARP (Address Resolution Protocol).
Q31. Explain the difference between ICMP Type 3, Code 3 and Type 3, Code 4.
Type 3 is Destination Unreachable. Code 3 is Port Unreachable, indicating that the destination host does not have the specified port open. Code 4 is Fragmentation Needed but DF Set, used in Path MTU Discovery to tell the source that the packet is too large and cannot be fragmented.
Q32. Why is ICMP considered part of the network layer, not the transport layer?
ICMP is encapsulated directly in IP datagrams (protocol number 1) and does not use port numbers. It provides control and error messages for the IP layer itself, which is characteristic of the network layer. It is not used to transport user data.
Q33. How does a host know that an ICMP Echo Reply corresponds to a particular Echo Request?
Each Echo Request contains an Identifier and a Sequence Number in the payload. The Echo Reply echoes these back, allowing the sender to match replies to requests.
Q34. What is the purpose of ICMP Redirect messages and why might they be considered a security risk?
ICMP Redirect informs a host of a better route to a destination. A malicious user could send forged Redirect messages to alter a host's routing table, directing traffic to an attacker's machine, enabling man‑in‑the‑middle attacks.
Q35. Describe the role of ICMP in Path MTU Discovery and explain what happens if ICMP messages are blocked.
PMTUD uses ICMP Fragmentation Needed (Type 3, Code 4) messages to inform the source of a smaller MTU. If these ICMP messages are blocked, the source never learns the correct MTU and may continue sending large packets that are dropped, causing a "black hole" condition where connections hang.
Q36. A user reports that they cannot ping a remote server, but they can traceroute to it. What could be the reason?
The remote server or an intermediate firewall may block ICMP Echo Requests (type 8) but allow other ICMP types (like Time Exceeded) needed for traceroute. Also, the server may be configured to ignore pings but still send ICMP errors.
Q37. A router receives a datagram with TTL=1 and forwards it? What happens? What ICMP message is generated?
The router decrements TTL to 0, discards the datagram, and sends an ICMP Time Exceeded (Type 11, Code 0) back to the source.
Q38. A host sends a UDP datagram to a destination port that is not open. What ICMP message does the destination host send back?
The destination host will send an ICMP Destination Unreachable (Type 3) with Code 3 (Port Unreachable).
Q39. In a traceroute, the source receives ICMP Time Exceeded from router R1, then from R2, but then no response. What might be the issue?
Either the destination host is unreachable (no route), the packets are being filtered, or the destination host does not send ICMP Port Unreachable (if using UDP traceroute) or Echo Reply (if using ICMP traceroute). Firewalls may block the final probe.
Q40. Explain how an attacker could use ICMP Redirect to perform a man‑in‑the‑middle attack.
The attacker sends a forged ICMP Redirect message to a host, claiming that a better route to a specific destination is via the attacker's machine. The host updates its routing table and sends subsequent traffic to the attacker, who can then intercept, modify, or forward the traffic.
Q41. Why is it recommended to filter incoming ICMP Echo Requests at the perimeter? What is the trade‑off?
Filtering prevents external hosts from discovering internal hosts and reduces attack surface (ping floods). The trade‑off is that legitimate diagnostics from external sources (e.g., monitoring tools) may not work, and internal hosts cannot ping external hosts if the filter is applied to outgoing as well (usually it's incoming only).
Q42. A network administrator notices that ICMP Time Exceeded messages are being dropped by a firewall. How would this affect traceroute?
Traceroute relies on receiving ICMP Time Exceeded messages from intermediate routers to build the path. If these are dropped, traceroute will show asterisks (*) for those hops and may not be able to complete, making it difficult to diagnose routing paths.
Q43. What is the difference between ICMP Echo Request and Echo Reply in terms of the 'Type' field?
Echo Request has Type = 8, Echo Reply has Type = 0. Both have Code = 0.
Q44. In IPv6, which ICMPv6 messages are used for Neighbor Discovery?
Neighbor Solicitation (NS, Type 135), Neighbor Advertisement (NA, Type 136), Router Solicitation (RS, Type 133), Router Advertisement (RA, Type 134).
Q45. Why is the ICMP checksum required, given that IP has its own checksum?
The IP checksum only covers the IP header, not the payload. ICMP messages are the payload of IP datagrams, so ICMP needs its own checksum to ensure the integrity of the ICMP message itself.
Q46. How does a host determine the path MTU using ICMP? Describe the steps.
The host sends a large packet with the DF flag set. If a router on the path has a smaller MTU, it drops the packet and sends an ICMP Destination Unreachable (Type 3, Code 4) back, including the MTU of the next hop. The host then reduces the packet size and retransmits, repeating until no such messages are received, thus discovering the path MTU.
Q47. What is the 'Identifier' field used for in ICMP Echo messages?
The Identifier is used to match Echo Requests with Echo Replies, allowing multiple concurrent ping sessions. It is often set to the process ID or a random number.
Q48. Can ICMP messages themselves be fragmented? Why or why not?
Yes, ICMP messages are encapsulated in IP datagrams, which can be fragmented if they exceed the MTU. However, ICMP error messages are usually small (about 64 bytes) and rarely fragment.
Q49. What is the role of the 'Next Hop MTU' field in ICMP Fragmentation Needed messages?
It provides the MTU of the link that caused the fragmentation failure, allowing the source to adjust its packet size accordingly.
Q50. A host sends a ping to a destination but receives "Destination Unreachable" with code 1. What does this indicate?
Code 1 for Destination Unreachable is Host Unreachable, meaning the router could not forward the datagram to the destination host (likely no route to the host).
What is the ICMP type and code for a message that indicates "Network Unreachable"?
Type = 3 (Destination Unreachable), Code = 0 (Network Unreachable).
Explain the difference between ICMP Type 11, Code 0 and Type 11, Code 1.
Type 11 is Time Exceeded. Code 0 indicates TTL expired in transit (sent by a router when TTL becomes 0). Code 1 indicates fragment reassembly timeout (sent by a host when not all fragments arrive within the timer).
A traceroute using ICMP Echo Requests receives a "Time Exceeded" from router R1, then from R2, but then a "Destination Unreachable" (Port Unreachable) from the destination. What does this indicate about the path?
It indicates that the path to the destination is complete: routers R1 and R2 are intermediate, and the final destination responded with Port Unreachable (since the probe used a high port, indicating the destination is reachable).
Why is ICMP redirect considered a security risk? Propose a mitigation.
ICMP redirect can be spoofed to alter routing tables, leading to MITM attacks. Mitigation: ignore ICMP redirect messages on hosts, or configure routers to not send them.
How does Path MTU Discovery use ICMP to determine the optimal packet size?
PMTUD sends packets with the DF flag set. When a router with a smaller MTU receives such a packet, it drops it and sends an ICMP Destination Unreachable (Type 3, Code 4) with the MTU of the next hop. The source reduces its packet size and retries until no such ICMP messages are received, establishing the path MTU.
A network administrator wants to allow ping but block ICMP Redirect messages. What firewall rules should they implement?
Allow ICMP Type 0 (Echo Reply) and Type 8 (Echo Request) for ping. Block ICMP Type 5 (Redirect). Additionally, allow necessary error types (Type 3, Type 11) for PMTUD and diagnostics.
What is the ICMP message sent when a router receives a datagram with an invalid IP header option?
ICMP Parameter Problem (Type 12). Code 0 indicates pointer indicates error, or Code 1 for missing required option, etc.
Explain how ICMP can be used for network reconnaissance (e.g., ping sweeps). How can this be mitigated?
An attacker can send ICMP Echo Requests to a range of IP addresses to find live hosts (ping sweep). Mitigation: block incoming ICMP Echo Requests at the firewall, or rate‑limit them.
A host sends a ping to a destination but receives no reply and no error message. What could be the reasons?
Possible reasons: ICMP traffic is blocked by a firewall, the destination is down, the destination does not respond to pings, or the packets are being dropped due to congestion or routing issues.
Describe the difference between ICMP Router Solicitation and Router Advertisement.
Router Solicitation (Type 10) is sent by a host to request router information; Router Advertisement (Type 9) is sent by routers periodically or in response to solicitations to inform hosts of router addresses and parameters.
What is the ICMP message used for "Fragmentation Needed but DF set" and what is its code?
Type 3 (Destination Unreachable), Code 4.
Explain why ICMP error messages are not sent in response to other ICMP error messages (to avoid storms).
To prevent infinite loops and flooding, ICMP error messages are not generated for errors that occur while processing other ICMP error messages, for fragmented packets (except the first fragment), or for broadcast/multicast packets.
What is the default TTL used by ping on most operating systems? How does this affect packet traversal?
Typically 64 (Linux) or 128 (Windows). This limits the number of hops the packet can traverse; if the destination is farther than the TTL, the packet will be dropped with Time Exceeded.
How does ICMPv6 differ from ICMPv4 in terms of error handling and neighbor discovery?
ICMPv6 includes Neighbor Discovery (NDP) which replaces ARP and other IPv4 functions. ICMPv6 has additional types for NDP (Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement). Error messages are similar but adapted for IPv6.
An ICMP Echo Request has Identifier = 0x1234 and Sequence = 5. What will the Echo Reply contain for these fields?
The Echo Reply will contain the same Identifier (0x1234) and Sequence (5) to allow matching.
Research the history of ICMP and its evolution. Write a 500‑word essay covering its creation, key RFCs, and how it has adapted to new requirements (e.g., IPv6).
ICMP was defined in RFC 792 (1981). It has been extended with new types and codes. ICMPv6 (RFC 4443) introduced Neighbor Discovery. ICMP remains essential for network diagnostics and control.
Compare and contrast ICMP Echo Request/Reply (ping) with TCP SYN‑based connectivity tests (e.g., hping). Discuss the advantages and disadvantages of each.
Ping is simple, lightweight, and widely available, but can be blocked. TCP SYN tests can bypass some filters but require open ports and may be seen as scanning. TCP tests also measure application‑layer connectivity.
Explain the role of ICMP in the "ping of death" attack and how modern systems protect against it.
The ping of death sent oversized ICMP packets that caused buffer overflows. Modern systems check packet size before processing and reject oversized packets.
Describe how ICMP is used for router discovery and why it has been largely replaced by DHCP.
Router Discovery (ICMP Router Solicitation/Advertisement) allows hosts to find routers. DHCP provides more comprehensive configuration (IP, DNS, etc.) and is more widely used.
Investigate the concept of "ICMP tunneling" and how it can be used for covert communication.
ICMP tunneling encapsulates other protocols within ICMP Echo packets to bypass firewalls. It can be used for data exfiltration or covert channels.
Explain the difference between ICMP error messages for "Network Unreachable" and "Host Unreachable". When might each occur?
Network Unreachable (code 0) means the router has no route to the network. Host Unreachable (code 1) means the router has a route to the network but cannot reach the specific host (e.g., ARP failure).
Describe the process of a typical traceroute implementation that uses UDP packets. Why does it need ICMP?
Traceroute sends UDP packets with increasing TTL. Routers send ICMP Time Exceeded (type 11) when TTL expires. The destination sends ICMP Port Unreachable (type 3, code 3) when the UDP packet reaches a closed port, indicating the end of the path.
What are the security considerations for allowing ICMP in a corporate network? Write a policy recommendation.
Recommend allowing essential ICMP types (Echo Request, Echo Reply, Destination Unreachable, Time Exceeded) but rate‑limit them. Block Redirect and Router Solicitation/Advertisement. Use ACLs to restrict internal ICMP.
Explain the concept of "ICMP redirect" and why it is often disabled on hosts and routers.
ICMP redirect informs a host of a better route. It is often disabled to prevent potential MITM attacks and because routing is better handled by dynamic routing protocols.
How does ICMPv6 handle Neighbor Discovery and what are the main message types?
ICMPv6 Neighbor Discovery includes Router Solicitation (133), Router Advertisement (134), Neighbor Solicitation (135), Neighbor Advertisement (136), and Redirect (137). It replaces ARP and handles address resolution and router discovery.
Discuss the impact of ICMP rate limiting on network diagnostics. How can network administrators balance security and usability?
Rate limiting can delay diagnostic responses. Administrators can set reasonable thresholds, allow specific sources (e.g., internal monitoring), or use alternative tools like TCP‑based tests.
What is the purpose of the ICMP "Source Quench" message and why is it obsolete?
Source Quench (Type 4) was intended to signal congestion to the source. It is obsolete because it is not effective and can be abused; TCP congestion control is now used.
Describe how ICMP is used in the "Smurf" attack and how it can be mitigated.
Smurf sends ICMP Echo Requests to a broadcast address with spoofed source, causing all hosts to reply to the victim. Mitigation: disable directed broadcasts on routers, filter spoofed packets.
Explain the relationship between ICMP and Path MTU Discovery. What happens if ICMP Fragmentation Needed messages are filtered?
PMTUD relies on ICMP Type 3, Code 4. If filtered, the source never learns the MTU, leading to packet loss and connection stalls (black hole).
Compare the ICMP implementation in IPv4 and IPv6, focusing on the changes and new functionalities.
IPv6 ICMP (ICMPv6) includes Neighbor Discovery, which replaces ARP. It also has new types like Packet Too Big. Error messages are similar but adapted for 128‑bit addresses.
This tutorial has provided a comprehensive exploration of the Internet Control Message Protocol (ICMP). Key takeaways:
Understanding ICMP is essential for network troubleshooting, security, and understanding how the network layer supports diagnostics. In the next tutorial, we will explore IPv6 architecture and operations.