Networking · 28 min read
ICMP
The internet's control and error messaging companion to IP: how hosts and routers report problems, probe reachability, and discover path limits.
Why this exists
IP forwarding moves packets, but networks also need a side channel for 'that did not work' and 'are you there?' Without standardized error and diagnostic messages, every router vendor would invent a private way to say destination unreachable or time exceeded.
ICMP (and ICMPv6) carry those signals: unreachable destinations, time exceeded for traceroute, echo for ping, and packet-too-big for path MTU discovery.
Operators filter ICMP aggressively because it can be abused. Learners need to know both why ICMP is essential and why blind blocking creates mysterious black holes.
Axioms & primitives
- 01ICMP is a companion to IP for control and error messages, not a transport for ordinary application payloads.
- 02Many ICMP messages quote part of the offending packet so the sender can match the error to a flow.
- 03Ping uses echo request/reply; traceroute uses hop-limit expiry (and related tricks).
- 04Path MTU discovery depends on packet-too-big (or fragmentation-needed) feedback.
- 05Filtering all ICMP 'for security' often breaks diagnostics and sometimes breaks legitimate transfers.
- 06ICMP messages themselves are best-effort and may be rate-limited or dropped.
Learning objectives
After this lesson you should be able to:
- Explain what ping proves and what it does not prove about application health.
- Describe how classic traceroute discovers hops using TTL/hop limit.
- Explain how ICMP packet-too-big connects to path MTU discovery failures when ICMP is filtered.
- Distinguish an 'ICMP filtered' symptom from a 'destination down' symptom.
- List at least three common ICMP message purposes beyond echo.
Progressive depth
Read the layers in order for a full explanation. Or open the layer you need.
Intuition
When a router cannot deliver a packet, it would be rude and useless to stay silent forever. ICMP is how the network says things like 'no route,' 'forbidden,' or 'your packet lived too long looping.'
Ping is the friendly face of ICMP: send an echo, hope for a reply, measure time. Traceroute is the exploratory face: provoke time-exceeded messages from successive hops.
Think of ICMP as instrumentation and error reporting for the internet layer, not as a replacement for TCP or HTTP.
Formal shape
ICMPv4 and ICMPv6 messages have types and codes. Important families include destination unreachable, time exceeded, echo request/reply, redirect (host guidance), and packet too big (IPv6) / fragmentation needed (IPv4 DF set).
Error messages typically include the IP header and first bytes of the original payload so the sender can demultiplex which socket or flow failed.
Neighbor Discovery for IPv6 uses ICMPv6 for router advertisements and neighbor solicitations, overlapping jobs that IPv4 split across ARP, DHCP options, and ICMP redirects.
Security controls: rate limits, filters, and replies that reveal topology. Responsible operators allow the ICMP needed for PMTUD and often allow echo within reason, while blocking abusive patterns.
Worked examples
Ping 8.8.8.8: if replies return, you have a working path for ICMP echo to that address and a RTT sample. If it fails, you may still have working HTTP via another path, or ICMP may be filtered while TCP works.
Traceroute: send probes with hop limit 1,2,3,... Collect time-exceeded from routers and a final reply from the destination. Stars mean no reply, not necessarily a missing continent.
PMTUD failure: a tunnel lowers effective MTU; large TLS records vanish; small packets work. Enabling ICMP packet-too-big through middleboxes, or clamping MSS/MTU, restores progress.
Destination unreachable from a router after a firewall policy can look like 'host down' in naive tools. Read the code when you can capture it.
Edge cases
ICMP is easy to spoof on networks without ingress filtering; trust ICMP content cautiously.
Anycast destinations make ping RTTs jump as routing shifts. Comparing ping to two resolvers is not a pure latency lab.
Some networks prioritize or deprioritize ICMP differently from TCP, so ping latency can disagree with application latency.
IPv6 without ICMPv6 is operationally broken in ways IPv4 veterans underestimate. Do not copy 'block ICMP' runbooks blindly into IPv6.
Mental models
Return to sender slip
Postal service stamps 'address unknown' on a form and sends it back. ICMP is that slip for packets.
Sonar pings
Echo request/reply is sonar: measure round trip if something answers. Silence is ambiguous.
Breadcrumb TTL
Traceroute deliberately under-bakes the hop limit so intermediate routers confess themselves with time-exceeded messages.
Common misconceptions
Myth
If ping works, the website works.
Reality
Ping tests ICMP echo reachability to a host/IP. HTTP can still be down, firewalled on 443, or broken in TLS/app logic.
Myth
Blocking all ICMP hardens a network with no downside.
Reality
You lose diagnostics and can break PMTUD, causing large-packet stalls that look like random hangs.
Myth
ICMP is IPv4-only trivia.
Reality
IPv6 relies heavily on ICMPv6 for Neighbor Discovery and PMTUD; it is not optional decoration.
Myth
Traceroute shows every router on the path accurately always.
Reality
Hops may not reply; load balancing can show diamonds; tunnels hide inner hops.
Exercises
Work these without looking up answers first. Check yourself against the intent notes.
Exercise 01
A user can browse HTTPS sites but ping to those sites' IPs fails. Give two explanations consistent with a working web path.
What good looks like
ICMP echo filtered; ping to anycast/different VIP than HTTPS; middlebox allows 443 only.
Exercise 02
Explain how traceroute uses hop limit, and why a hop showing * * * is ambiguous.
What good looks like
Probes expire; routers may rate-limit or hide ICMP; not proof the hop dropped the original user traffic.
Exercise 03
Design a minimal checklist for diagnosing a 'large downloads hang, small pages work' symptom involving ICMP.
What good looks like
Suspect PMTUD/MTU; test with reduced MTU/MSS; check ICMP filtering on path; consider tunnels/VPN.
Sources & further reading
External references. Prefer primary documents and clear explainers.
- RFC 792 - Internet Control Message Protocol
high
- RFC 4443 - ICMPv6
high
- An introduction to computer networks
high · 2017-maps
Go deeper on your own
These picks go past the foundation in this lesson. Use them when you want a primary spec, official docs, or a longer walkthrough.
Defines ICMPv4 message types used by ping and path errors. Read it when tools output cryptic ICMP codes.
- RFC 4443: ICMPv6Paper
ICMPv6 for IPv6, including neighbor discovery roles. Use it when your lab moves off IPv4-only networks.
Official registry of ICMP type and code numbers. Use it when a packet dump shows a type you do not recognize.