ICMP

Overview

ICMP (Internet Control Message Protocol) is the internet's messaging system for diagnostics and error reporting. It is not used to carry your application data, but to tell hosts and routers about network conditions — "destination unreachable," "time exceeded," and the familiar echo used by ping.

Learning objectives

• Define ICMP and its purpose.
• Identify common ICMP message types.
• Understand ICMP's security considerations.

Core concept

ICMP is a Layer 3 (Internet-layer) helper protocol that carries control and error messages between network devices. Unlike TCP or UDP, it does not transport user data; it reports on the network itself. Common ICMP messages include:

• Echo Request / Echo Reply — used by ping to test reachability.
• Destination Unreachable — a host, network, or port cannot be reached.
• Time Exceeded — a packet's TTL (time-to-live) hit zero, used by traceroute.
• Redirect — informs a host of a better route.

How it works

Routers and hosts generate ICMP messages automatically as conditions arise. If a router drops a packet because its TTL expired, it sends an ICMP "Time Exceeded" back to the source — a mechanism traceroute exploits to map the path hop by hop. If a service's port is closed, an ICMP "Destination Unreachable (port unreachable)" may be returned. These messages give hosts feedback they would otherwise lack.

Practical example

Running traceroute (or tracert on Windows) to a website sends packets with increasing TTL values. Each router that discards a packet for expired TTL replies with an ICMP Time Exceeded, revealing that hop's address. The list of replies maps the route your traffic takes across the internet — built entirely from ICMP feedback.

Cybersecurity relevance

ICMP is a double-edged tool. Defenders and admins rely on it for diagnostics, but attackers use it for reconnaissance (ping sweeps to find live hosts, traceroute to map networks) and occasionally for tunneling data or floods (ICMP flood DoS). Consequently, some networks rate-limit or restrict ICMP — which can hinder legitimate troubleshooting, a real trade-off between security and manageability.

Common mistakes

• Thinking ICMP carries application data — it carries control/error messages only.
• Blocking all ICMP indiscriminately, which breaks useful diagnostics and can cause subtle failures (e.g. path MTU discovery).

Key takeaways

• ICMP is a control/error-reporting protocol at the Internet layer, not a data-transport protocol.
• Common messages include Echo (ping), Destination Unreachable, Time Exceeded (traceroute), and Redirect.
• ICMP aids diagnostics but is also used for recon and attacks, so it is often restricted with care.

Check your understanding

• How does traceroute use ICMP Time Exceeded messages to map a path?
• Why might an organization restrict ICMP, and what is the downside of doing so bluntly?