5.5 Internet Control Message Protocol (ICMP) & Ping / Traceroute

Back to Computer Networks Notes

📚Module 05: Network Layer: Routing Protocols & Control PlaneTopic 5.5⏱️20 min read

🎯High-Yield For:Semester Exams (All Universities) • Placement Technical Rounds • Engineering Foundations

💡 Core Intuition: The Postal Return-to-Sender Stamp

🍳 The Everyday Analogy: Undeliverable Mail Diagnostics

Imagine dropping a sealed letter into a public mailbox:

• If the destination street address no longer exists, the recipient has moved, or the bridge to the town has collapsed, the postal carrier cannot deliver the envelope.
• The postal service does not silently toss your letter into an incinerator without telling you.
• Instead, the post office affixes an official diagnostic stamp: "RETURN TO SENDER: Undeliverable as Addressed — Reason: No Such Street", and mails the envelope back to your return address so you understand why delivery failed.

💻 Bridging to Computer Science: IP is Best-Effort; ICMP is the Diagnostic Companion

The Internet Protocol (IPv4/IPv6) was architected with a fundamental philosophy: best-effort, connectionless simplicity.

• IP contains zero error-reporting mechanisms and zero diagnostic query features.
• If a router's buffer overflows, a link MTU is too small for an unfragmentable packet, or a packet's Time-to-Live (TTL) decrements to zero, IP silently discards the datagram.

To prevent the Internet from operating in the dark, the Internet Control Message Protocol (ICMP) was designed as IP's companion control protocol. When a datagram is dropped or reachability must be verified, ICMP formats an informational packet and sends it back to the original source IP address.

---

📑Table of Contents

• 🔬 ICMP Architecture & The 32-Bit Message Format
  • Universal ICMP Message Layout
  • Why Include the Original Header + First 8 Bytes?
• 📋 Comprehensive Taxonomy of ICMP Messages
  • 1. Error-Reporting Messages
  • 2. Query / Diagnostic Messages
• 🛡️ The 4 Golden Rules of ICMP Error Suppression
• 🛠️ Deep-Dive into Diagnostic Utilities: Ping & Traceroute
  • 1. ping: End-to-End Reachability Probe
  • 2. traceroute / tracert: Step-by-Step Path Discovery
• 🏭 Real-World Production Context: Path MTU Discovery (PMTUD) & The ICMP Black Hole Trap
  • 1. Path MTU Discovery (PMTUD) Mechanics (RFC 1191)
  • 2. The Dreaded ICMP Black Hole Trap
• 📐 Numerical Applications & Worked Examples
  • Example 1: Total Byte Overhead of an ICMP Error Datagram
  • Example 2: Traceroute Hop-by-Hop Probe Analysis
  • Example 3: Path MTU Discovery Sequence
• 🎯 Exam & Interview Pitfall Check

---

🔬 ICMP Architecture & The 32-Bit Message Format

Defined in RFC 792 (IPv4) and RFC 4443 (ICMPv6), ICMP is positioned squarely at the Network Layer (Layer 3):

Network Layer Architectural Encapsulation

ICMP operates as an internal Layer 3 companion encapsulated directly in IPv4

Layer 4

Transport Protocols & Applications

🔄

User applications communicating via TCP and UDP socket streams.

HTTP/HTTPSDNSSSHBGP (TCP 179)

↓Transport Segments

Layer 3

Internet Protocol & Control Plane

🌐

Best-effort datagram delivery accompanied by ICMP error reporting.

IPv4 DatagramsICMP (Protocol 1)IGMPOSPF (Protocol 89)

↓Network Datagrams

Layer 2

Data Link Subsystem

⚡

Node-to-node physical frame delivery across local broadcast domains.

Ethernet IIIEEE 802.3Wi-Fi (802.11)ARP (0x0806)

Even though ICMP messages are encapsulated directly inside IPv4 datagrams (Protocol = 1 in the IPv4 header), ICMP is not a transport layer protocol. It serves as an integral internal subsystem of the Network Layer itself.

Universal ICMP Message Layout

Every ICMP message starts with an 8-byte header aligned to 32-bit words, followed by context-specific data:

Network Layer ProtocolTotal Packet: 20 to 60 Bytes

Universal ICMP Message & Error Datagram Layout (RFC 792)

Standard 32-bit word alignment showing Type, Code, Checksum, and Error Context Payload

Byte 0 (Bits 0–7)Byte 1 (Bits 8–15)Byte 2 (Bits 16–23)Byte 3 (Bits 24–31)

048121620242831

Word 0Bytes 0–3

Type8b

00001011

Code8b

00000000

Checksum16b

0x4F2A

Word 1Bytes 4–7

Message-Specific Header Content32b

Word 2Bytes 8–11

Original IPv4 Header (20 to 60 Bytes)32b

Word 3Bytes 12–15

First 64 Bits (8 Bytes) of Original Datagram Data32b

Whole Packet Encapsulation

📦

Data Payload (Transport Layer Segment)Encapsulates TCP Segment / UDP Datagram / ICMP Message

Variable Length (up to 65,515 Bytes)

8 BitsPattern: 00001011Type

Identifies message category (e.g. Type 3 = Unreachable, Type 11 = Time Exceeded, Type 8 = Echo Request).

Why Include the Original Header + First 8 Bytes?

When an intermediate router drops a packet and transmits an ICMP error message back to the source host:

• The source host might be running hundreds of concurrent network applications (web browsers, SSH sessions, games).
• By including the original IPv4 header + first 8 bytes of the offending transport payload, the source operating system can extract: $\text{First 8 Bytes of Transport Header} \implies \begin{cases} \text{TCP/UDP Source Port} & (2\text{ bytes}) \\ \text{TCP/UDP Destination Port} & (2\text{ bytes}) \\ \text{TCP Sequence Number} & (4\text{ bytes}) \end{cases}$
• The kernel matches this 5-tuple against its internal socket table and raises a runtime error (e.g. Connection Refused or Host Unreachable) to the exact application thread that dispatched the packet!

---

📋 Comprehensive Taxonomy of ICMP Messages

ICMP messages are divided into two fundamental functional categories: Error-Reporting Messages and Query Messages.

1. Error-Reporting Messages

Type	Name	Code	Diagnostic Meaning
3	Destination Unreachable	0	Network Unreachable: No routing table entry exists for the destination network.
		1	Host Unreachable: Target router found network, but ARP resolution failed (host offline).
		2	Protocol Unreachable: Destination host OS does not support the requested Layer 4 protocol.
		3	Port Unreachable: Destination host reached, but no application socket is listening on target port.
		4	Fragmentation Needed & DF Set: Packet size exceeds link MTU, but DF = 1. Basis of PMTUD!
		5	Source Route Failed: Strict source route option cannot be satisfied.
11	Time Exceeded	0	TTL Expired in Transit: TTL reached $0$ at an intermediate router. Basis of Traceroute!
		1	Fragment Reassembly Time Exceeded: Destination reassembly timer expired before all fragments arrived.
12	Parameter Problem	0	Pointer Indicates Error: Ambiguous or corrupted field in the IPv4 header (Pointer byte points to error).
		1	Missing Required Option: Mandatory IP option was omitted.
5	Redirection	0 - 3	Informs host that a more optimal first-hop router exists on the local LAN for this destination.
4	Source Quench	0	(Deprecated by RFC 6633) Flow control congestion notification; prone to spoofing.

2. Query / Diagnostic Messages

Type	Name	Code	Operational Function
8	Echo Request	0	Sent by diagnostic utilities (ping) to test end-to-end layer-3 reachability.
0	Echo Reply	0	Returned by destination host in response to an Echo Request.
13	Timestamp Request	0	Requests remote clock time to calculate one-way propagation delay and clock sync.
14	Timestamp Reply	0	Contains Originate, Receive, and Transmit 32-bit timestamps (milliseconds since midnight UT).
17	Address Mask Request	0	(Legacy) Host broadcasts to discover its local subnet mask. (Replaced by DHCP).
18	Address Mask Reply	0	Router responds with the authoritative 32-bit subnet mask for the local link.
9	Router Advertisement	0	Router periodically advertises its presence and default gateway IP (RFC 1256).
10	Router Solicitation	0	Host broadcasts upon boot to discover active local default gateways immediately.

---

🛡️ The 4 Golden Rules of ICMP Error Suppression

To prevent malicious denial-of-service loops and catastrophic broadcast storms, RFC 792 strictly enforces four universal suppression rules:

The 4 Golden Rules of ICMP Error Message Suppression

Mandatory RFC 792 safety invariants preventing recursive storms and denial-of-service amplification

1️⃣

No Error on Error

Rule of Termination

• Never generate an ICMP error in response to an ICMP error message.
• Prevents infinite recursive feedback loops between failing routers.
• (Query messages like Echo Request CAN generate errors).

2️⃣

First Fragment Only

Offset = 0 Filter

• Errors are generated strictly for fragmented datagrams with Offset = 0.
• Subsequent fragments (Offset > 0) are dropped silently.
• Prevents generating redundant duplicate errors for a single dropped datagram.

3️⃣

No Error on Broadcast

Storm Prevention

• Never generate errors for broadcast or multicast destinations.
• Prevents Smurf attack denial-of-service amplification.
• Protects entire subnets from simultaneously replying to a single malformed frame.

4️⃣

Valid Source IP Only

Unicast Validity

• Never generate errors for special sources (0.0.0.0 or loopback 127.0.0.1).
• Routers cannot transmit diagnostic packets to non-routable originators.
• Prevents self-directed loops within the router kernel.

1. No ICMP Error Message Will Be Generated in Response to an ICMP Error Message:
   • If an ICMP Destination Unreachable packet itself encounters a dead link and drops, the router silently discards it.
   • Generating an error for an error would trigger an infinite recursive ping-pong storm across failing links!
   • (Note: ICMP Query messages like Echo Request CAN generate ICMP errors if unreachable).
2. No ICMP Error For Fragmented Datagrams Beyond the First:
   • If an unreassembled fragment is discarded, an ICMP error is generated only if the fragment has Offset $= 0$.
   • For subsequent fragments ($Offset > 0$), no error is generated. Otherwise, dropping a 10-fragment datagram would generate 10 identical redundant error packets!
3. No ICMP Error For Broadcast or Multicast Datagrams:
   • A router will NEVER generate an ICMP error if the destination IP address was a broadcast (255.255.255.255, subnet directed broadcast) or a multicast group (224.0.0.0/4).
   • Otherwise, sending a single packet could cause hundreds of nodes to respond simultaneously, saturating the network (Smurf Attack amplification).
4. No ICMP Error For Datagrams with Invalid or Special Source Addresses:
   • If the source IP is 0.0.0.0, loopback 127.0.0.1, or an invalid reserved address, no error is transmitted. Routers cannot send replies to invalid destinations.

---

🛠️ Deep-Dive into Diagnostic Utilities: Ping & Traceroute

1. ping: End-to-End Reachability Probe

The ping command is the fundamental network connectivity diagnostic:

1. Source constructs an ICMP Echo Request (Type 8, Code 0) containing an Identifier (PID) and an incrementing Sequence Number.
2. The destination host OS kernel intercepts the packet and immediately responds with an ICMP Echo Reply (Type 0, Code 0), mirroring the payload.
3. The sender measures the elapsed time to calculate Round Trip Time (RTT): $\text{RTT} = t_{\text{reply\_received}} - t_{\text{request\_sent}}$

# Terminal trace of a 4-packet ICMP ping probe
$ ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=14.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=13.8 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=118 time=14.1 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 13.812/14.037/14.215/0.168 ms

2. traceroute / tracert: Step-by-Step Path Discovery

Traceroute uncovers the exact sequence of intermediate Layer 3 routers traversed between source and destination by deliberately exploiting the IPv4 Time-to-Live (TTL) field!

Architecture Flow

Hop-by-Hop Traceroute Execution Pipeline

Incrementing TTL from 1 upwards to reveal intermediate routers via ICMP Time Exceeded

1️⃣Hop 1

TTL = 1 Probe

Router 1 decrements TTL to 0, drops packet, and returns ICMP Type 11 Code 0 (Time Exceeded).

→

Reveals R1 IP

2️⃣Hop 2

TTL = 2 Probe

Traverses R1, decrements to 0 at Router 2, which drops and returns ICMP Type 11 Code 0.

→

Reveals R2 IP

3️⃣Hop 3

TTL = 3 Probe

Traverses R1 and R2, decrements to 0 at Router 3, which drops and returns ICMP Type 11 Code 0.

→

Reveals R3 IP

🎯Target

Destination Reached

Destination receives packet. High-port UDP triggers ICMP Type 3 Code 3 (Port Unreachable)!

Linux traceroute vs Windows tracert: The Critical Architectural Distinction

Dimension	Unix / Linux traceroute	Windows tracert
Probe Protocol	UDP Datagrams destined to high, unused ports (33434 to 33534)	ICMP Echo Request (Type 8, Code 0)
Intermediate Response	ICMP Type 11, Code 0 (Time Exceeded)	ICMP Type 11, Code 0 (Time Exceeded)
Final Target Response	ICMP Type 3, Code 3 (Port Unreachable)! Since no application listens on port 33434.	ICMP Type 0, Code 0 (Echo Reply)! Destination responds to ping.
Termination Trigger	Receipt of Port Unreachable signals traceroute to stop.	Receipt of Echo Reply signals tracert to stop.

---

🏭 Real-World Production Context: Path MTU Discovery (PMTUD) & The ICMP Black Hole Trap

1. Path MTU Discovery (PMTUD) Mechanics (RFC 1191)

Modern IP implementations avoid fragmentation at all costs because losing a single fragment corrupts the entire TCP segment. Instead, hosts dynamically discover the minimum MTU across the entire path using Path MTU Discovery (PMTUD):

1. Host sets the Don't Fragment (DF = 1) bit in the IPv4 header and transmits full-sized packets (e.g. $1500\text{ bytes}$).
2. If an intermediate router connects to a link with a smaller MTU (e.g. a VPN tunnel with $\text{MTU} = 1420\text{ bytes}$), the router cannot fragment the packet because $DF = 1$.
3. The router drops the datagram and returns an ICMP Type 3, Code 4 message: $\text{"Fragmentation Needed and DF Set"}$
4. Crucially, the router includes the Next-Hop MTU ($1420$) in the unused 32-bit field of the ICMP header!
5. The sending host reads the $1420\text{ byte}$ limit and lowers its TCP Maximum Segment Size (MSS) accordingly.

Space-Time Protocol Ladder

Step 1 of 4

Path MTU Discovery (PMTUD) & Packet Too Big Exchange

Host discovers bottleneck MTU via ICMP Type 3 Code 4 without fragmentation

💡Click or hover any packet flight arrow, timer event, or step button to inspect protocol mechanics in real time

💻Transmitter (DF=1)

Client Host

Lifeline Rail (t ↓)

🔀Next MTU: 1420B

Edge Router

Lifeline Rail (t ↓)

🌐Destination

Web Server

Lifeline Rail (t ↓)

1IPv4 Datagram (1500B, DF=1)Lost(Exceeds Next Link MTU)

2ICMP Type 3, Code 4(Next-Hop MTU = 1420B)

3IPv4 Datagram (1420B, DF=1)(Resized to Fit Path MTU)

4IPv4 Datagram (1420B, DF=1)(Delivered Intact)

Step 1 of 4client ➔ router❌ Packet Lost in TransitIPv4 Datagram (1500B, DF=1)

Client transmits 1500-byte datagram with DF=1. Edge router cannot fragment because DF is set, and drops the packet.

2. The Dreaded ICMP Black Hole Trap

In production enterprise networks, security administrators frequently configure firewalls to block all ICMP packets indiscriminately, mistakenly believing that blocking ICMP makes servers "invisible to hackers":

• When a client sends small packets (TCP SYN, ACK), everything works because packets are smaller than the VPN MTU.
• When the server responds with a large data burst (e.g., loading a webpage with $1500\text{B}$ packets), the router drops them and sends ICMP Type 3 Code 4.
• The firewall drops the ICMP message! The server never receives the notification and retransmits the $1500\text{B}$ packet until connection timeout.
• Symptom: Webpage connection establishes instantly, but the page spins forever and hangs indefinitely! This is an ICMP Black Hole.

---

📐 Numerical Applications & Worked Examples

Example 1: Total Byte Overhead of an ICMP Error Datagram

Problem Statement: A router receives an IPv4 datagram carrying a UDP payload. The router decrements the TTL to zero and drops the datagram. It formats an ICMP Time Exceeded error message and encapsulates it into a new IPv4 packet to send back to the source. Calculate the exact total size (in bytes) of the generated IP datagram assuming base headers with no IP options.

Step-by-Step Solution:

1. Identify the Components of an ICMP Error Message:

   • An ICMP Error payload consists of: $\text{Original IPv4 Header} + \text{First 8 Bytes of Original Transport Payload}$
   • Original IPv4 Header (no options) $= 20\text{ bytes}$.
   • First 8 bytes of original transport (UDP) payload $= 8\text{ bytes}$.
   • Total ICMP Payload size $= 20 + 8 = \mathbf{28\text{ bytes}}$.

2. Calculate the ICMP Message Header Size:

   • ICMP Base Header (Type, Code, Checksum, Message-Specific Data) $= 8\text{ bytes}$.
   • Total ICMP Message size $= 8\text{ (Header)} + 28\text{ (Payload)} = \mathbf{36\text{ bytes}}$.

3. Calculate the Total Encapsulated IPv4 Datagram Size:

   • The new outer IPv4 Header $= 20\text{ bytes}$.
   • Total Encapsulated Packet Size $= 20\text{ (Outer IP Header)} + 36\text{ (ICMP Message)} = \mathbf{56\text{ bytes}}$.
   • Result: The router transmits exactly $56\text{ bytes}$ over the physical network.

---

Example 2: Traceroute Hop-by-Hop Probe Analysis

Problem Statement: An engineer runs Linux traceroute from Host $S$ to Host $D$ across three intermediate routers $R_1, R_2, R_3$.

1. What are the Layer 3 Protocol and Layer 4 Port numbers in the outbound probe packet when $TTL = 2$?
2. What ICMP Type and Code are received by $S$ from $R_2$?
3. When the probe reaches final destination $D$, what ICMP Type and Code are returned?

Step-by-Step Solution:

1. Outbound Probe at $TTL = 2$:
   • Layer 3 Protocol: IPv4 with Protocol = 17 (UDP) and TTL = 2.
   • Layer 4 Destination Port: A high unassigned port (e.g., 33435).
2. Intermediate Router Response ($R_2$):
   • Packet traverses $R_1$ (TTL decrements from $2 \to 1$).
   • Packet arrives at $R_2$ (TTL decrements from $1 \to 0$).
   • $R_2$ discards the packet and returns ICMP Type 11, Code 0 (Time Exceeded in Transit).
3. Final Destination Response ($D$):
   • When probe reaches Host $D$ with sufficient TTL, Host $D$ inspects the UDP header.
   • Because no application is listening on port $33435$, Host $D$'s operating system drops the UDP segment and returns ICMP Type 3, Code 3 (Destination Unreachable: Port Unreachable).

---

Example 3: Path MTU Discovery Sequence

Problem Statement: A client communicates with a server across a path containing three sequential links with MTUs: $\text{Link 1: } 1500\text{ bytes} \quad \longrightarrow \quad \text{Link 2: } 1300\text{ bytes} \quad \longrightarrow \quad \text{Link 3: } 1400\text{ bytes}$

1. If the client sends a $1500\text{ byte}$ datagram with $DF = 0$, what occurs at the router connecting Link 1 and Link 2?
2. If the client sends a $1500\text{ byte}$ datagram with $DF = 1$, trace the PMTUD exchange and determine the maximum segment size the client will subsequently use.

Step-by-Step Solution:

1. Case 1: $DF = 0$ (Fragmentation Allowed):
   • The router fragments the $1500\text{ byte}$ datagram into two fragments to fit Link 2's $1300\text{ byte}$ MTU:
     • Fragment 1: $1280\text{ bytes}$ data ($160 \times 8$) $+ 20\text{B header} = 1300\text{ bytes}$ ($MF = 1, Offset = 0$).
     • Fragment 2: $200\text{ bytes}$ data $+ 20\text{B header} = 220\text{ bytes}$ ($MF = 0, Offset = 160$).
   • No ICMP error is generated.
2. Case 2: $DF = 1$ (Fragmentation Prohibited - PMTUD):
   • The router cannot fragment the packet. It discards the datagram.
   • Router generates an ICMP Type 3, Code 4 message containing Next-Hop MTU = 1300.
   • Client receives the ICMP error and caches the Path MTU for this destination as $1300\text{ bytes}$.
   • Subsequent packets sent by the client will have a maximum total size of $1300\text{ bytes}$ (with TCP MSS $= 1300 - 20\text{ (IP)} - 20\text{ (TCP)} = \mathbf{1260\text{ bytes}}$).

---

🎯 Exam & Interview Pitfall Check

Core Conceptual Questions

• Why does the ICMP error packet copy the original IP header + first 8 bytes of the offending transport datagram?
  Because IP is connectionless, the source host might have multiple active sockets and processes communicating across the network. The original IP header identifies the destination, and the first 8 bytes of the transport header contain the original Source Port and Destination Port. This allows the source OS to identify the exact application process that caused the error and deliver the notification to the correct socket.

• How does Linux traceroute detect that it has reached the ultimate destination versus an intermediate router?
  Intermediate routers return ICMP Type 11 Code 0 (Time Exceeded) when their TTL counter decrements to zero. When the probe reaches the ultimate destination host, the TTL does not expire; instead, because traceroute deliberately targets an unused high-numbered UDP port ($> 33434$), the destination host rejects the packet with ICMP Type 3 Code 3 (Destination Unreachable: Port Unreachable). Receiving Port Unreachable signals traceroute that the path traversal is complete.

Common Interview Traps

• Trap: Classifying ICMP as a Transport Layer protocol because it is encapsulated in IP.
  Debunked: ICMP is strictly a Network Layer (Layer 3) protocol. Although it is encapsulated inside IP packets (Protocol 1), it provides zero transport-layer services (no port multiplexing, no reliable connection management, no flow control). It acts as an internal control and diagnostic plane for the Network Layer itself.

• Trap: Assuming ICMP error messages are generated when an ICMP Echo Reply is dropped.
  Debunked: Under the First Golden Rule of ICMP Suppression, no ICMP error message will ever be generated in response to an ICMP error message. If an ICMP error packet drops in transit, it is discarded silently to prevent infinite feedback storms.

---

🗺️View Complete Computer Networks Roadmap & Syllabus

← Previous Topic5.4 Border Gateway Protocol (BGP) & Path Vector RoutingNext Topic →5.6 Address Resolution Protocol (ARP) & Reverse ARP (RARP)