ICMP
IP's control plane for errors and diagnostics. Ping and traceroute ride it.
Level: beginner
What is it?
Internet Control Message Protocol (ICMP) carries error reports and diagnostic messages associated with IP delivery. Tools such as ping and traceroute use ICMP in common modes, though traceroute implementations can also use UDP or TCP probes.
Why does it matter?
IP itself is best-effort, so endpoints and routers need a way to report certain delivery problems and support diagnostics. ICMP helps locate failures but filtering and path behavior mean no single ICMP result proves full application availability.
Mental model
ICMP is control and diagnostic signaling alongside IP, not a reliable application transport. A destination-unreachable message is a clue from a router or host; an echo reply proves that a particular echo request/reply path worked at that moment.
How it works
- IPv4 ICMP and ICMPv6 have different message definitions and roles; ICMPv6 is especially important for IPv6 operation.
- Ping commonly uses echo request/reply messages but can be filtered even when the application service works.
- Traceroute often relies on TTL/Hop Limit expiry and ICMP time-exceeded responses from intermediate hops.
- Destination-unreachable messages can report network, host, port, or policy-related failures depending on message type/version.
- ICMP messages may be rate-limited or filtered, so missing replies do not always mean packets cannot reach a destination.
Steps
- A diagnostic tool sends an echo request or a probe with a limited TTL/Hop Limit.
- A host or router processes the probe and may generate an ICMP response.
- The diagnostic tool measures response time or the hop where expiry occurred.
- Compare the result with TCP/UDP application tests and route information before concluding the service is down.
Real-world usage
- Using ping and traceroute to diagnose paths and delay.
- Interpreting destination-unreachable and packet-too-big feedback.
Common mistakes
- Treating failed ping as proof that every service is unreachable.
- Assuming traceroute always uses the same probe protocol.
- Blocking all ICMPv6 without understanding its role in neighbor and path-MTU discovery.
Interview questions
What does traceroute learn from TTL/Hop Limit?
It causes probes to expire at successive hops, often eliciting ICMP time-exceeded messages that reveal intermediate routers.
Why might ping fail while HTTPS works?
The network may filter or rate-limit ICMP echo while still permitting TCP port 443 and the application response.