ICMP (Internet Control Message Protocol) Internet Control Message Protocol Carries error and diagnostic messages between hosts and routers. A ping is an ICMP message. Covered in §5.6.
introduced in ch. 2 is how the network layer reports on itself: short messages
carried inside IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use.
introduced in ch. 1 datagrams that say what went wrong, and that
ping and traceroute are built out of.
Words you will meet
-
ICMP icmp Simple How the network layer reports errors about itself. Precise Internet Control Message Protocol: messages carried in the payload of IP datagrams with upper-layer protocol number 1, reporting errors and diagnostics about IP delivery. Each carries the header and first 8 bytes of the datagram that caused it. ping and traceroute are built on it. introduced in ch. 5 — open in glossary — Internet Control Message Protocol: hosts and routers use it to tell each other about network-layer conditions.
-
Type and code — two small numbers that name what an ICMP message is about.
-
ping ping Simple Ask a host to send one message straight back. Precise A program that sends an ICMP type 8 code 0 echo request to a named host. The destination host, seeing the echo request, sends back a type 0 code 0 echo reply. Most TCP/IP implementations support the ping server directly in the operating system, so no process is listening for it. introduced in ch. 5 — open in glossary — a program made of exactly two ICMP messages.
-
traceroute traceroute Simple A program that lists every router on the path to a destination and the delay to each. Precise A program that sends N specially marked packets toward a destination; the nth router along the path returns a message to the source instead of forwarding packet n. The source thereby reconstructs the route and measures the round-trip delay to each router. Described in RFC 1393. introduced in ch. 1 — open in glossary — a program that finds every router on a path, using nothing but the TTL (Time To Live) Time To Live How long a cached DNS record may be kept before it must be fetched again. introduced in ch. 2 field and ICMP replies.
-
Source quench source quench Simple An old ICMP message asking a sender to slow down. Precise ICMP type 4 code 0. Its original purpose was congestion control: a congested router could send it to a host to force that host to reduce its transmission rate. It is seldom used in practice — TCP has its own congestion control at the transport layer, and Explicit Congestion Notification bits let network-layer devices signal congestion instead. introduced in ch. 5 — open in glossary — an old ICMP message for congestion control, now seldom used.
-
ICMPv6 icmpv6 Simple The version of ICMP that goes with IPv6. Precise A new version of ICMP defined for IPv6 in RFC 4443. Besides reorganising the existing type and code definitions, it adds new types and codes required by IPv6 functionality, including a Packet Too Big type and an unrecognized IPv6 options error code. introduced in ch. 5 — open in glossary — the version defined for IPv6 (Internet Protocol version 6) Internet Protocol version 6 The Internet Protocol with 128-bit addresses and a fixed 40-byte header, without fragmentation at routers or a header checksum. introduced in ch. 4 .
Why this matters
Everything in this chapter so far has been about computing forwarding tables. Nothing has been about what happens when the network cannot do what it was asked.
ICMP is that. When a router cannot find a path to the host in your request, it creates and sends an ICMP message, and your browser turns it into “Destination network unreachable”.
It also happens to be the foundation of the two tools every network person
reaches for first. ping is two ICMP messages. traceroute is a clever misuse
of one field in the IP header, and this page takes it apart.
Where ICMP sits
ICMP is often considered part of IP, and architecturally it lies just above it. ICMP messages are carried as IP payload, exactly as TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 or UDP (User Datagram Protocol) User Datagram Protocol A simple transport protocol with no reliability, no flow control and no congestion control. introduced in ch. 1 segments are.
When a host receives an IP datagram whose upper-layer protocol number is 1, it demultiplexes the contents to ICMP, just as it would demultiplex to TCP or UDP. That is the same demultiplexing idea as section 3.2, one layer down.
In plain words
“Just above IP” is a careful phrase and it is worth keeping.
ICMP is not inside IP. It has its own message format and its own checksum. The IP header points to it with a protocol number, exactly as it points to TCP with 6 and UDP with 17.
But ICMP is not a transport protocol either. It carries no ports, opens no connections and delivers nothing to an application. It talks about the network, to the network.
What an ICMP message contains
ICMP messages have a type and a code field. An error message also contains the header and the first 8 bytes of the IP datagram that caused it, so the sender can work out which datagram failed.
Click any box to read what that part of the message is for.
Every field, as text
- Type — 8 bits — which kind of message this is (example: 11)
- Code — 8 bits — which variety of that kind (example: 0)
- Checksum — 16 bits — covers the whole ICMP message (example: 0x2f1a)
- Unused (zero) — 32 bits — padding, for the error types (example: 0x00000000)
Type, code and checksum are always there. What follows an error message is a copy of the datagram that caused it — and eight bytes of a UDP datagram happen to be its entire header, which is why the sender can read its own port numbers back out.
| Code | Description | |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it. Sortable columns have a ↕ in the heading.
The book’s own table, unchanged. Note the second column: type 3 alone covers six different failures. Click a cell marked ⓘ.
Note that ICMP messages are used not only for signalling error conditions. Types 0 and 8 are the ping pair, and types 9 and 10 are router advertisement and router discovery.
ping
The well-known ping program sends an ICMP type 8 code 0 message to the
specified host. The destination host, seeing the echo request, sends back a type
0 code 0 echo reply.
Click any arrow to see what that message says and why it is sent.
The whole of ping. Two messages, no connection, no ports, and nothing listening on the far side.
Read this diagram as text
- Lin’s laptop sends ICMP type 8 code 0 · echo request to www.example.edu. The ping program sends an ICMP type 8 code 0 message to the specified host. There is no transport layer here at all: the ICMP message sits directly inside an IP datagram whose protocol field is 1.
- www.example.edu sends ICMP type 0 code 0 · echo reply to Lin’s laptop. The destination host, seeing the echo request, sends back a type 0 code 0 echo reply, with the identifier, the sequence number and every data byte copied back unchanged. Most TCP/IP implementations support the ping server directly in the operating system — the server is not a process.
Lifelines, left to right: Lin’s laptop (host), www.example.edu (server).
Two details in that exchange are easy to miss.
Nothing is listening. Most TCP/IP (Transmission Control Protocol / Internet Protocol) Transmission Control Protocol / Internet Protocol The collective name for the Internet's principal protocols. It became the ARPAnet standard on 1 January 1983. introduced in ch. 1 implementations support the ping server directly in the operating system; the server is not a process. There is no socket, no port, and no program to start.
The client needs permission. The ping client program has to be able to
instruct the operating system to generate an ICMP message of type 8 code 0. An
ordinary program cannot simply write one, which is why ping often needs extra
privileges.
Source quench: a fix that was replaced
Type 4 code 0 is the source quench source quench Simple An old ICMP message asking a sender to slow down. Precise ICMP type 4 code 0. Its original purpose was congestion control: a congested router could send it to a host to force that host to reduce its transmission rate. It is seldom used in practice — TCP has its own congestion control at the transport layer, and Explicit Congestion Notification bits let network-layer devices signal congestion instead. introduced in ch. 5 — open in glossary message, and the book says it is seldom used in practice.
Its original purpose was congestion control. A congested router could send one to a host to force that host to reduce its transmission rate — congestion control imposed from the middle of the network.
Two things replaced it. TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 grew its own congestion-control mechanism at the transport layer, which chapter 3.7 covers in detail. And ECN (Explicit Congestion Notification) Explicit Congestion Notification Network-assisted congestion control [RFC 3168]: routers mark two bits in the IP header so senders can slow down before loss occurs (§3.7.2). introduced in ch. 3 bits let network-layer devices signal congestion without generating a whole extra message, as section 3.7.2 described.
The idea did not disappear. It moved.
traceroute
Chapter 1 introduced traceroute, which traces a route from a host to any other
host in the world. It is implemented with ICMP messages, and the mechanism is
worth admiring.
An ordinary IP datagram carrying a UDP segment with an unlikely port number. The source starts a timer for it. Nothing about this datagram is special except the TTL.
One probe per hop is shown. The standard program sends sets of three packets with the same time-to-live, which is why real traceroute output has three results on each line.
Read all steps as text
- Send a datagram with a time-to-live of 1 — An ordinary IP datagram carrying a UDP segment with an unlikely port number. The source starts a timer for it. Nothing about this datagram is special except the TTL.
- Hop 1 discards it and complains — According to the rules of IP, the router discards the datagram and sends an ICMP warning back to the source: type 11, code 0. That warning carries the router’s own name and IP address, and it arrives while the timer is still running.
- Now 2, then 3, then 4 — Each new probe survives one hop further before its time-to-live runs out, so each one is reported by the next router along. The source collects an address and a round-trip time per hop, in order.
- Eventually a probe arrives — One datagram finally has enough time-to-live to reach the destination host itself. No router discards it, so no time-exceeded message comes back.
- And the host says nobody is listening — The probe carries a UDP segment with an unlikely port number, so the destination host replies with port unreachable — type 3, code 3. When the source receives that particular message, it knows it does not need to send any more probes. That is how traceroute stops.
The source sends a series of ordinary IP datagrams to the destination. Each carries a UDP segment with an unlikely port number. The first has a time-to-live ipv4 time-to-live Simple A counter in every datagram saying how many more routers it may cross. Precise TTL: an 8-bit IPv4 header field, decremented by one each time the datagram is processed by a router. At zero the router must drop it. It exists so that datagrams do not circulate for ever in a routing loop, and it is what makes traceroute possible. introduced in ch. 4 — open in glossary of 1, the second 2, the third 3, and so on, and the source starts a timer for each one.
When the nth datagram arrives at the nth router, that router sees that the TTL has just expired. By the rules of IP it discards the datagram and sends an ICMP warning to the source, type 11 code 0. That message carries the router’s own name and address. So when it arrives the source learns two things at once: the identity of hop n, and the round-trip time from its timer.
Stopping is the clever part. One datagram eventually reaches the destination host. Because it carries a UDP segment with an unlikely port number, the host answers with port unreachable, type 3 code 3. That message is different from all the others, and receiving it is how the source knows to stop.
In plain words
traceroute never asks any router anything.
It sends datagrams that are designed to fail, one hop further along each time, and lets each failure report itself. Every router on the path identifies itself because the rules of IP oblige it to complain, not because anybody queried it.
The two different failures are what make it work. “Your TTL expired” means keep going. “No such port” means you have arrived.
Two things the client must be able to do
The book is specific about this, and it explains why traceroute is a system
tool rather than an ordinary program.
The client must be able to instruct the operating system to generate UDP datagrams with specific TTL values — not the default the system would choose.
And it must be able to be notified by its operating system when ICMP messages arrive. Those messages are not addressed to any port, so there is no socket they would naturally land in.
Watching it happen
Here is the whole run, captured on Lin’s laptop: five probes with rising time-to-live, four routers reporting themselves, the destination host refusing the port, and then a single ping.
| No. | Time | Source | Destination | Protocol | Length | Info |
|---|---|---|---|---|---|---|
| 1 | 0.000000 | 192.168.1.24 | 198.51.100.7 | UDP | 54 | 45678 → 33434 Len=12 [TTL=1] |
| 2 | 0.001000 | 192.168.1.1 | 192.168.1.24 | ICMP | 70 | Time-to-live exceeded (type 11, code 0) ← hop 1: home router / access point |
| 3 | 0.005000 | 192.168.1.24 | 198.51.100.7 | UDP | 54 | 45678 → 33435 Len=12 [TTL=2] |
| 4 | 0.014000 | 41.72.10.1 | 192.168.1.24 | ICMP | 70 | Time-to-live exceeded (type 11, code 0) ← hop 2: ISP-A, Bangkok |
| 5 | 0.018000 | 192.168.1.24 | 198.51.100.7 | UDP | 54 | 45678 → 33436 Len=12 [TTL=3] |
| 6 | 0.114000 | 203.0.113.1 | 192.168.1.24 | ICMP | 70 | Time-to-live exceeded (type 11, code 0) ← hop 3: Tier-1-T, transit backbone |
| 7 | 0.118000 | 192.168.1.24 | 198.51.100.7 | UDP | 54 | 45678 → 33437 Len=12 [TTL=4] |
| 8 | 0.296000 | 192.0.2.1 | 192.168.1.24 | ICMP | 70 | Time-to-live exceeded (type 11, code 0) ← hop 4: university border router |
| 9 | 0.300000 | 192.168.1.24 | 198.51.100.7 | UDP | 54 | 45678 → 33438 Len=12 [TTL=5] |
| 10 | 0.480000 | 198.51.100.7 | 192.168.1.24 | ICMP | 70 | Destination port unreachable (type 3, code 3) ← the destination host |
| 11 | 0.500000 | 192.168.1.24 | 198.51.100.7 | ICMP | 74 | Echo (ping) request (type 8, code 0) id=0x1a2b seq=1 |
| 12 | 0.680000 | 198.51.100.7 | 192.168.1.24 | ICMP | 74 | Echo (ping) reply (type 0, code 0) id=0x1a2b seq=1 |
Packet 1 — Traceroute probe 1. An ordinary UDP datagram to an unlikely port, with the time-to-live set by hand to 1.
Protocol tree — click a field
The actual bytes
0000 aa bb cc 00 00 01 aa bb cc 00 00 11 08 00 45 00 ..............E.0010 00 28 2b 10 00 00 01 11 a2 ba c0 a8 01 18 c6 33 .(+............30020 64 07 b2 6e 82 9a 00 14 3f 1c 40 41 42 43 44 45 d..n....?.@ABCDE0030 46 47 48 49 4a 4b FGHIJK
Captured on Lin’s laptop. Five probes with rising time-to-live, four routers reporting themselves, the destination host refusing the port, and then a single ping. One probe per hop; the real program sends three.
Find the quoted header yourself
Select any of the ICMP time-exceeded packets, open its ICMP layer, and click the field “quoted IP header of the datagram that caused this”.
Twenty bytes light up in the hex pane. Compare them with the IP header of the probe two rows above: they are identical, byte for byte, because the router copied them.
Then click the next field, the quoted first 8 bytes. Those are the probe’s whole UDP header, including the port numbers the laptop chose. That is the sentence “so that the sender can determine the datagram that caused the error”, made concrete.
Everyday picture
You want to know which post offices a parcel passes through, and nobody will tell you.
So you post a parcel with a note: “destroy this after 1 sorting office and write to me”. Then one with “after 2 offices”. Then 3. Each office that destroys a parcel writes to you with its own address on the letter.
Eventually a parcel survives all the way to the address. The recipient returns it marked “no such department” — a different kind of letter, and that is how you know to stop posting.
Where the picture stops. A sorting office might quietly bin your parcel without writing. Routers do sometimes do this too: some are configured not to send ICMP at all, which is why a real traceroute often has lines of asterisks in the middle.
ICMP for IPv6
A new version of ICMP has been defined for IPv6 in RFC (Request For Comments) Request For Comments The name of an IETF standards document. There are currently nearly 9000 of them. introduced in ch. 1 4443.
Besides reorganising the existing type and code definitions, ICMPv6 adds new types and codes that IPv6 needs. The book names two: a “Packet Too Big” type, and an “unrecognized IPv6 options” error code.
Check yourself
Check yourself
0 of 7 answered1.Where does ICMP sit relative to IP?
2.Why does an ICMP error message carry the header and the first 8 bytes of the datagram that caused it?
3.You run ping. What is listening on the destination host?
4.predicttraceroute sends its first datagram with a TTL of 1. What happens to it?
5.How does traceroute know when to stop sending probes?
6.Why is the source quench message seldom used today?
7.In the capture on this page, the ICMP time-exceeded replies come from four different source addresses. Why does that matter?
What to remember
- ICMP lies just above IP, not inside it. Its messages travel as IP payload, and the IP protocol number that selects it is 1. It is not only for errors: echo, router advertisement and router discovery are ICMP too.
- An error message quotes the header and the first 8 bytes of the datagram that caused it, so the sender can tell which one failed. Eight bytes of a UDP datagram is its whole header.
- traceroute sets the TTL by hand, 1 then 2 then 3, and lets each router’s complaint identify it. It never queries anything, and it stops on a different message: type 3 code 3 means you have arrived.