ICMP
Internet Control Message ProtocolICMP is how the network reports back. IP itself carries no way to say “that didn’t arrive” — ICMP fills the gap, sending error and diagnostic messages when a packet can’t be delivered, is too big, or outlives its hop budget. It is also the engine behind ping and traceroute.
ICMP is IP’s status channel — it carries errors and diagnostics, never application data.
Open the ICMP lab →
Ping: echo request and reply, TTL counting down hop by hop, and how traceroute reads the failures.
How it works
Ping is simpler still: an Echo Request (type 8) out, an Echo Reply (type 0) back — the round trip is the latency you see.
What ICMP does, step by step
An ICMP message is carried as the payload of an IP packet — no ports, no connection, no handshake.
A router that can’t deliver sends back an error — unreachable, too big, or time exceeded.
The error carries the start of the original packet, so the sender knows exactly which one failed.
Echo request/reply is ping; expiring TTLs on purpose is traceroute — both are just ICMP.
In cybersecurity
ICMP is invaluable for diagnostics but is also a reconnaissance and covert-channel tool — the trick is filtering the dangerous types without breaking the ones the network needs.
Echo sweeps and error responses map which hosts are alive — often the first step of an attack.
Dropping every ICMP breaks Path MTU Discovery, so connections silently hang — permit types 3 & 11.
Data hidden in echo payloads smuggles traffic past filters that wave ping through unquestioned.
Spoofed echoes to a broadcast once amplified DDoS; rate-limiting and no directed-broadcast end it.
A forged type-5 redirect can steer a host onto an attacker’s gateway — most systems now ignore them.
Throttling ICMP keeps diagnostics working while blunting scans and floods — the pragmatic middle.