What Is ICMP?

ICMP can troubleshoot network connectivity problems.

ICMP stands for Internet Control Message Protocol, a lightweight set of applications originally designed to detect and report error conditions on computer networks. ICMP is an extension of the Internet Protocol (IP) and is defined by a memorandum, known as Request for Comments (RFC) 792, published by the Internet Engineering Task Force.

Purpose

ICMP allows hosts, routers and other networking devices to exchange basic control information, such as error and status information, when data is sent from one device to another. So ICMP is useful for probing a network to determine its general characteristics or for troubleshooting network connectivity problems. If a network administrator understands ICMP and the possible causes of specific types of ICMP messages, he or she is better equipped to diagnose network problems.

Structure

Each ICMP message contains three fields, known as type, code and checksum. The type field identifies the ICMP message, the code field provides further information about the message, dependent on the message type, and the checksum field determines the integrity of the message. The ping utility, for example, sends an echo request ICMP message, with a type field of 8 and a code field of 0, and expects to receive an echo reply message, with a type field of 0 and a code field of 0. If the destination host is unreachable, a destination unreachable ICMP message, with a type field of 3 and a code field corresponding to one of 16 possible conditions, is generated.

IP Datagram

Each ICMP message is encapsulated in a self-contained packet of data, known as an IP datagram, which contains enough information for it to be forwarded, or routed, across the network from the source to the destination. In fact, ICMP is an integral part of IP and is a necessary part of any IP implementation. ICMP is, however, a control and networking protocol, so is used for transferring network status information, rather than application data.

Application

The most well-known application is "ping", which is used to determine whether a given network host is reachable or not. ICMP is unique because, unlike some other protocols, such as the User Datagram Protocol (UDP) and Transmission Control Protocol (TCP), it doesn't use ports to communicate. ICMP message can get lost and not be delivered. A simple request, such as determining if a host is reachable, doesn't needs ports to communicate or reliable delivery.

References

• "Network Intrusion Detection"; Stephen Northcutt, Judy Novak; 2002
• Microsoft Support: Internet Control Message Protocol (ICMP) Basics
• SANS Institute: ICMP Attacks Illustrated