ICMP Fundamentals: What Happens When Packets Go off the rails (Part 1)

Welcome to the first post in my series on the Internet Control Message Protocol, or ICMP. If you’ve ever wondered how network tools like ping and traceroute work, or what happens when a packet can’t find its destination, then you’ve come to the right place. We’re going to dive into the fundamentals of ICMP, exploring its crucial role in keeping the internet’s traffic flowing and diagnosed.

What is ICMP?

The Internet Protocol (IP) is designed to be a simple, no-frills delivery service. It does its best to get data packets from a source to a destination, but on its own, it’s a bit of a black box. If a packet fails to arrive, IP provides no direct way for the sender to know what went wrong. Did it get lost in a routing loop? Was the destination host offline? IP doesn’t say. It also doesn’t offer any built-in tools for diagnostics, like figuring out which routers a packet passes through on its journey.

This is where the Internet Control Message Protocol (ICMP) steps in. ICMP works alongside IP to provide essential error reporting and diagnostic information. It’s so fundamental that it’s a required part of any IP implementation and is often considered a core part of the IP layer itself.

But let’s be clear: ICMP does not make IP reliable. It simply reports on certain types of failures. In fact, the most common reason for a packet to be dropped, a router’s buffer overflowing with too much traffic doesn’t trigger any ICMP message at all. Reliability is a job for higher-level protocols like TCP.

ICMP exists in two main flavors: ICMPv4 for IPv4 networks and ICMPv6 for IPv6. While they serve similar purposes, ICMPv6 plays a much more central role in the day-to-day operation of IPv6 than its v4 counterpart does. Because ICMP can be used to gather network information and affect system operations, it has unfortunately been used by hackers in various attack also. As a result, network administrators often configure firewalls to block certain ICMP messages. The downside is that blocking ICMP can break common and useful diagnostic tools, which is why understanding ICMP is so important.

How ICMP Messages are Built

ICMP messages don’t travel the network on their own; they are encapsulated within IP datagrams for transport.

In an IPv4 packet carrying an ICMPv4 message, the Protocol field in the IPv4 header is set to a value of 1.
In an IPv6 packet, the Next_Header field of the last header before the ICMPv6 message is set to a value of 58.

All ICMP messages, for both v4 and v6, share a common basic structure for the first four bytes. The rest of the message content depends on the specific type of message being sent.

This header consists of three key fields:

Type (8 bits): This identifies the general purpose of the message. For example, an ICMPv4 “Echo Request” (the message a ping sends) is Type.
Code (8 bits): This provides more specific information about the message. A “Destination Unreachable” message (Type 3), for instance, can have different codes to specify why the destination was unreachable.
Checksum (16 bits): This is an error-checking field that covers the entire ICMP message. IP itself doesn’t have a checksum for the data it carries, so this ICMP checksum ensures the message content hasn’t been corrupted in transit. If a system receives an ICMP message with a bad checksum, it simply discards it and continue to accepting new pacjet.

Key ICMPv4 Error Messages

ICMP messages fall into two broad categories, error messages and informational/query messages

Error messages are generated in response to a problem, like a packet that couldn’t be delivered. To prevent network-clogging feedback loops (known as “broadcast storms”), strict rules govern when ICMP error messages can be sent. For example, an ICMP error message is never generated in response to another ICMP error message.

When an error message is generated, it always includes the IP header plus the first several bytes of the original IP datagram that caused the error. This is crucial because it allows the original sender’s system to figure out which protocol (e.g., TCP or UDP) and which application process the error relates to.

Let’s look at three of the most common and important ICMP error messages.

1. Destination Unreachable (Type 3)

This is one of the most common ICMP messages. It’s sent when a router or the final host cannot deliver a packet to its ultimate destination, While there are many codes for this message, a few are particularly common:

Host Unreachable (Code 1): This is generated when the last-hop router cannot find the destination host on the local network. This often happens if an ARP request for the host’s physical address goes unanswered, meaning the host is likely offline or nonexistent.
Port Unreachable (Code 3): The packet successfully arrived at the destination host, but the host’s operating system found that no application was listening on the target port number. This frequently occurs with UDP-based applications. If you send a UDP packet to a server port that isn’t running a service, the server’s UDP module will respond with an ICMP Port Unreachable message.
Fragmentation Needed and Don’t Fragment Was Set (Code 4): This is a special and very important message. It’s sent by a router that needs to fragment a large packet to send it over a network with a smaller Maximum Transmission Unit (MTU). However, if the packet’s IP header has the “Don’t Fragment” (DF) bit set, the router can’t fragment it. Instead, it drops the packet and sends this error message back to the sender. This mechanism is the foundation of Path MTU Discovery (PMTUD), which helps systems determine the optimal packet size for a path to avoid fragmentation.

2. Time Exceeded (Type 11)

Every IPv4 packet has an 8-bit

Time-to-Live (TTL) field in its header. While originally intended to be a time limit in seconds, in practice it has become a hop count limit. Each time a packet passes through a router, the router decrements the TTL value by at least one.

If a router receives a packet with a TTL of 1, it decrements it to 0. At this point, the packet has “expired” and cannot be forwarded further. The router discards the packet and sends an ICMP Time Exceeded (Code 0) message back to the packet’s original sender (traceroute takes advanteg of this feature). Also this is a safety mechanism to prevent packets from getting stuck in infinite routing loops.

3. Parameter Problem (Type 12)

This is a catch-all error message used when a router or host finds a problem in a packet’s IP header that isn’t covered by any other ICMP error type. For instance, if a field contains an invalid value, this message is generated. To help with debugging, the message includes a Pointer field that indicates the exact byte offset in the original IP header where the problem was found.

Use Case: Ping and Traceroute in Action

The best way to understand ICMP is to see how it’s used by everyday networking tools.

Using `ping` to Check Reachability

The ping command is the simplest way to check if a remote host is online and reachable. It works by using ICMP’s Echo Request (Type 8) and Echo Reply (Type 0) messages.

Here’s the step-by-step:

When you run ping google.com, your machine sends an ICMP Echo Request message to google.com‘s IP address.
This request message includes an Identifier field (often the process ID of the ping program, to distinguish it from other ping sessions) and a Sequence Number that starts at 0 and increments with each new request.
If the destination host is reachable and not blocked by a firewall, its IP layer receives the Echo Request and responds with an ICMP Echo Reply message, sent back to your machine.
Crucially, the reply must contain the exact same Identifier, Sequence Number, and any optional data that was sent in the request. ping uses the sequence numbers to detect if packets were dropped or reordered.
To calculate the round-trip time (RTT), ping places a timestamp in the optional data area of the request. Since this data is echoed back, ping can compare the returned timestamp with the current time to calculate how long the round trip took

Using `traceroute` to Discover a Path

The traceroute tool cleverly uses the ICMP Time Exceeded message to discover the sequence of routers between your machine and a destination.

Here’s how it works, based on the example in the text:

traceroute first sends a packet (the example uses UDP, but the payload doesn’t matter as much as the IP header) toward the destination, but with the TTL field set to 1.
The very first router (let’s call it R1) receives the packet. It decrements the TTL from 1 to 0. The packet expires.
R1 discards the packet and sends an ICMP Time Exceeded message back to your machine. The source IP address of this ICMP message is R1’s IP address. Well! traceroute now knows the identity of the first hop.
Next, traceroute sends another packet, but this time with the TTL set to 2.
This packet makes it through R1, which decrements the TTL to 1 and forwards it. The second router, R2, receives the packet, decrements the TTL to 0, and discards it.
R2 now sends a Time Exceeded message back to your machine. traceroute has now discovered the second hop.
This process continues, with traceroute incrementing the TTL by one for each round of packets. Each successive router along the path will be the one to return a Time Exceeded message, revealing its identity one by one until the packet finally reaches the destination host.

By sending a few packets for each TTL value traceroute can also measure the RTT to each hop, giving you a detailed picture of the network path and its performance. It’s a brilliant application of a simple ICMP error message. isn’t it?!

Conclusion

ICMP is the unsung hero of the IP world. It provides the feedback and diagnostic capabilities that the barebones Internet Protocol lacks. From simple error messages like Destination Unreachable and Time Exceeded to the powerful tools they enable, ICMP is fundamental to operating and troubleshooting IP networks.

This was a basic into to ICMP. In the next post, we will explore ICMP’s informational messages and dive deeper into the expanded and even more critical role that ICMPv6 plays in modern networking.

I am still updating this post…