In order to be able to exchange status in­for­ma­tion or fault messages, nodes in TCP/IP networks access the Internet Control Message Protocol (ICMP). In par­tic­u­lar, ap­pli­ca­tion servers and gateways (routers) use the IP extension to display no­ti­fi­ca­tions of datagram problems to the packages’ sender. The structure, mode of operation and clas­si­fi­ca­tion in the internet protocol stack were specified in RFC 792 in 1981 RFC 792. For version 6 of the internet protocol RFC 4443 has been defined as the specific im­ple­men­ta­tion of ICMPv6.

By de­f­i­n­i­tion ICMP is a stand-alone protocol, even if the various no­ti­fi­ca­tions are in­te­grat­ed into regular IP packets. To this end, the Internet Protocol treats the optional extension as a higher layer protocol. Lots of fre­quent­ly-used network services, such as tracer­oute or ping, are based on the ICMP protocol.

How does ICMP work?

To un­der­stand how the protocol works, you first need to look at the structure of the ICMP, or the header.  This is directly linked to the IP header, which is marked by the protocol number 1 or 58 (ICMPv6) in the IP field “protocol.” The header data area of the Internet Control Message Protocol itself is limited and has the following form:

The first 8-bit “Type” field de­ter­mines what type of no­ti­fi­ca­tion the ICMP packet is. This in­for­ma­tion can be specified with the following “code” field, which is also 8 bits long. For example, an ICMP type 3 message specifies that the des­ti­na­tion of the data packet is un­avail­able, while the code specifies this in­for­ma­tion to determine whether it was the des­ti­na­tion network (0), the desired host (1) or the targeted port (3) that did not respond to the previous request. The ICMP checksum follows the in­for­ma­tion about the message type, and ensures the accuracy of the no­ti­fi­ca­tion. This is done the same way as other standard protocols’ checksums (IP, UDP, TCP).

Finally, the ICMP files are built and struc­tured dif­fer­ent­ly depending on the re­spec­tive type and the trig­ger­ing instance. The IP header often contains a listing of the first 64 bits of the data packet, which are re­spon­si­ble for the error message or the status query. When so-called ICMP tunneling takes place, this field is misused for sending useful data under firewalls’ radars or for es­tab­lish­ing an encrypted com­mu­ni­ca­tion channel between two computers.

What kinds of ICMP packets are there?

Due to the 8 bit field length, 256 different ICMP messages are the­o­ret­i­cal­ly possible, with about 40 of them being fixed (including some obsolete rep­re­sen­ta­tives) and some blocked for ex­per­i­men­tal use.
The majority of the numbers (42-252) are not currently assigned, but are reserved in principle. The IANA (Internet Assigned Numbers Authority) are re­spon­si­ble for assigning the numbers, and also regulate the as­sign­ment of IP address spaces and ports. We have sum­ma­rized some of the most important packet types based on the Internet Control Message Protocol in the following table:

ICMP type ICMPv6 type Type name Code De­scrip­tion
3 129 Echo Reply 0 Test for presence by answering a network ping
0 1 Des­ti­na­tion Un­reach­able 0–15 An ICMP message that informs, among others things, the in­ac­ces­si­bil­i­ty that specific com­po­nents (network, protocol, port, host) in the field “code” have with routing problems or firewall blocking.
5 137 Redirect Message 0–3 Notifying the redi­rec­tion of a packet for the specified network (0), the specified service and the network (2), or the specified service and host (3).
8 128 Echo Request 0 Network ping
9 134 Router Ad­ver­tise­ment 0 Used by routers to com­mu­ni­cate with different network clients.
11 3 Time Exceeded 0 oder 1 Status reports, that either report the lifespan (time to Live, TTL) of a packet (0), or the waiting time until the assembly of frag­ment­ed packets (1) has expired.
13 13 Timestamp 0 This provides the cor­re­spond­ing IP packet with a time stamp, which cor­re­sponds to the dispatch time and serves the syn­chro­niza­tion of two computers.
14 - Timestamp Reply 0 Response message an ICMP timestamp that the addressee sends after receiving one.
30 - Tracer­oute 0 An outdated ICMP message type used to track the path of a data packet in the network: today, email requests and rep­e­ti­tions are mainly used for this purpose.

Where ICMP and ICMPv6 are used

ICMP is crucially important in terms of com­mu­ni­ca­tion within IP networks, and is used by routers in par­tic­u­lar. However, servers and clients also make use of the Internet Protocol-coupled messages ca­pa­bil­i­ties and in doing so, obtain important network in­for­ma­tion.

A common usage scenario is the so-called network ping, which can be executed via the command line of the re­spec­tive operating system using ap­pli­ca­tions of the same name. The simple but useful di­ag­nos­tic tool is the easiest option to check the avail­abil­i­ty of a par­tic­u­lar host on the network. To do this, ping sends an IP packet including the ICMP (v6) “Echo Request” (type 8 or 128). After receiving this packet, the receiver responds with a data packet con­tain­ing the ICMP entry “Echo Reply” (type 0 or 129).  If the system that the ping was sent to is un­reach­able, the last remaining reachable network station sends a response packet. This is also extended by an ICMP component: type 3 or 1 “Des­ti­na­tion Un­reach­able.”

Routers in turn use ICMP for different purposes: per router ad­ver­tise­ment (ICMP type 9; ICMPv6 type 134) they set, for example all active network users in regular intervals about their at­ten­dance and different network in­for­ma­tion knowledge. They store the received data in their cache and make the router the standard gateway. In addition, routers try to optimize the path of data packets in the network through ICMP redirects (Type 5 or 137). Using this message type, the network in­ter­faces point a host to the existence of a better first hop (in­ter­me­di­ate station) for sending IP packets.

Go to Main Menu