ENGINEERING GUIDE · PROTOCOLS

ICMP Engineering Guide

Understand ICMPv4 and ICMPv6 messages, diagnostics, errors and the role ICMP plays in troubleshooting IP networks.

ICMPv4ICMPv6Diagnostics
The important bit: ICMP is part of the IP control and error-reporting machinery. Blocking all ICMP can break useful diagnostics and, for IPv6, important network functions.

In this guide

  1. What ICMP does
  2. Common messages
  3. Ping
  4. Traceroute
  5. Path MTU Discovery
  6. ICMPv6
  7. Troubleshooting

What ICMP does

The Internet Control Message Protocol provides control and error-reporting messages associated with IP delivery. It can report conditions such as an unreachable destination or an expired hop limit, and it supports diagnostic mechanisms such as Echo Request and Echo Reply.

ICMP does not make IP reliable. A control message can itself be lost or filtered, so the absence of an ICMP response does not automatically prove that the underlying destination or path is unavailable.

Common ICMP messages

ProtocolTypeMessageTypical use
ICMPv40Echo ReplyReply to ping
ICMPv43Destination UnreachableDelivery or service failure
ICMPv48Echo RequestPing request
ICMPv411Time ExceededTraceroute and expired TTL
ICMPv61Destination UnreachableDelivery failure
ICMPv62Packet Too BigPath MTU Discovery
ICMPv6128 / 129Echo Request / ReplyPing6
ICMPv6133–136Neighbour DiscoveryIPv6 neighbour and router discovery

Ping

Ping normally sends an Echo Request and expects an Echo Reply. A successful response demonstrates that the selected protocol path can return an ICMP response; it does not prove that every application or TCP/UDP service is reachable.

A timeout can have many causes: packet loss, routing problems, firewall policy, host filtering, rate limiting or a destination that is simply not responding to echo.

Traceroute

Classic traceroute techniques deliberately cause packets to expire at successive hops. Routers can return ICMP Time Exceeded messages, allowing the sender to learn which hop generated the response. Implementations differ: some traceroute variants use UDP or ICMP probes, while modern tools may also use other mechanisms.

Path MTU Discovery

Path MTU Discovery depends on receiving feedback when a packet is too large for a link along the path. In IPv4, a router can report that fragmentation is required when the Don't Fragment bit is set. In IPv6, routers do not fragment forwarded packets; ICMPv6 Packet Too Big messages are used to signal the usable MTU.

ICMPv6

ICMPv6 is much more than IPv6 ping. Neighbour Discovery uses ICMPv6 messages for functions including router discovery, neighbour discovery and address resolution. Security policy therefore needs to distinguish necessary ICMPv6 traffic from unwanted traffic rather than treating all ICMPv6 as disposable.

Troubleshooting

  1. Identify whether the test uses ICMPv4 or ICMPv6.
  2. Check the exact type and code if an error is returned.
  3. Check the source and destination addresses and routing path.
  4. Look for firewall, ACL and rate-limiting policy that may filter ICMP.
  5. For MTU problems, inspect PMTUD behaviour and returned Packet Too Big or fragmentation-needed messages.
  6. Compare packet captures at both ends when the control message is unexpected or absent.

Use the ICMP Message Analyzer as a quick reference for common types and codes.

References

  • RFC 792 — Internet Control Message Protocol.
  • RFC 4443 — ICMPv6 for IPv6.
  • RFC 8201 — Path MTU Discovery for IPv6.