ICMP Basics

We see that ICMP sits at this layer three. It sits right next to IP version 4 and IP version 6, so it is a layer 3 protocol. Although it operates a little differently: where we see IP version 4 and IP version 6 are used for routing, ICMP is really not used to route packets. In fact, we include an IP version 4 and IP version 6 header on the front end of our ICMP packets. So if we were to actually take a look at the datagram unit here, it would take the place of this TCP. You wouldn't have data at the end of this, but it would take the place of this TCP header right here. That's where it would sit, right there.

ICMP stands for Internet Control Message Protocol. ICMP, as we mentioned, operates at layer 3, and it's a way for devices to communicate back and forth to message about what's happening with IP packets.

Host reachability and ping

So for instance, ping is a well-known example of how ICMP packets can communicate. If I'm this computer right here, I can ping a device that's over on the other end. But if I am not able to get packets to the other end, I may end up getting a notification back from one of these other layer three devices saying that network can't be reached, or for some reason you're not able to get to the end device. Perhaps this machine right here recognizes that that machine or that network is unreachable at the time, and it might send a message back saying that the host is unreachable, or the destination service is unreachable, or the time to live has exceeded. So there's different messages that could be sent back to this machine, or it may receive a message back that it has been received successfully. So it's a messaging protocol that allows this communication back and forth to see if lines are open and connections are open, if there is any kind of difficulties.

As I mentioned, one of the examples is ping, and this machine will send an echo request, and that echo request will hopefully make it to this end machine, and that end machine will send back an echo reply. Once we get the echo reply, then we get some information. For instance, we know that this machine is up, but we also get information that the path is clear and you're able to get to there. We also get some information like the total time it takes to get there and back, the travel time that it takes, in milliseconds. So it includes a lot of good information on what is happening with that link.

The reply messages

As I mentioned, there's several different messages that can return back. For instance, this machine may send back that there is a protocol unreachable, or the port is unreachable. Or maybe one of these machines, maybe the router, sends back and says the host is unreachable. Or maybe one of these machines says that the network is unreachable. But there are types right here that are included within the information that's being sent back, so that way this machine knows why it's not receiving an echo reply from this machine.

ICMP also has some similar types that it can return, such as no route to the destination. So perhaps one of these routers sends back a message that says that network is not within our routing table, so no route to the destination. Perhaps there's a firewall in between here and there, and so this firewall may return that you're not allowed to make it into that network and it's administratively prohibited. There is the beyond the scope of source address, there is the address unreachable, and the port unreachable. So several different types of messages that can be sent back in this reply to notify this machine why it has not reached its end destination.

Time to live and hop limit

Part of our IP version 4 header, there's a time to live, and part of our IP version 6 header, there's a hop limit. That means that every single hop, that hop limit or that time to live will be decremented by one. So if we have a hop limit of two and it goes to this router and then it goes to this router, that's two hops, then it will send a message back and say that destination is unreachable.

When we do a ping we can actually set what the time to live or the hop limit is, and so we get a reply back saying that that destination is unreachable. Of course, most of the time the time to live and hop limit is set very high, so it makes it to its destination and sends it back. But it is something that we can change as a setting when we do our pings.

Traceroute

The reason why that is important is because traceroute will actually use that in order to map out what is between the two machines that are trying to communicate. So let's say this machine is pinging this machine right here, and a traceroute. What a traceroute will do: you type in traceroute on a Linux machine, or tracert on a Windows machine, and what it will do is it will send out a request, a ping essentially, out, and it will have a time to live of one. Then you will get a response back from this device right here saying destination unreachable. But you get some additional information about this machine right here, this router that's right here.

And then this machine will send something out saying, "Okay, I want to send a message, a request, do a ping request to this machine right here. I'm going to set a time to live of two." And it will send out, and there's one and two. This router right here will send a message back saying destination unreachable, and will include some information about this router right here.

Then next I am going to send out a ping request with a time to live of three, so it's going to go 1 2 3. Then this router will send a message back saying here is that destination is unreachable, and here's some information about myself. And then you send out a message with a time to live of four, and then this actually gets to its end destination, and a reply back says, "Yeah, you've reached me. Everything is good to go."

Meanwhile, now you have all of the information about the hops, or a lot of the information about the hops in between. This can be valuable because perhaps you're trying to figure out what is going wrong, where is the communication stopping. This could be one of those things that can tell you how far your packet is getting before it gets dropped. Or it could also tell you if there's big delays between these two devices. It will say, well, there wasn't much delay from this device, there wasn't much delay from this device, but there was a ton of delay from this device right here. So perhaps this machine right here, this router, is swamped with traffic right now, or perhaps this link is swamped with traffic and causing issues. So we get a lot of information with traceroute that we don't get with just a regular ping.

Neighbor discovery protocol

So ICMP packets are not just for troubleshooting and ping. We do use it for other things, especially, it's very critical when it comes to neighbor discovery protocol in IP version 6. The neighbor discovery protocol will use router solicitation and router advertisement to find out what IP address it should have. So there will be a router solicitation that will go out, that is sent to the router, and then a router advertisement will come back with information on how to get out to the rest of the world. So that is neighbor discovery protocol, and that is the router solicitation and router advertisement to set up this machine so it knows how to get to the outside world.

But another thing that it will do also is maybe it needs to communicate somewhere within its network. Then it will send out a neighbor solicitation and say, maybe it's trying to figure out the MAC address associated with a certain IP version 6 IP address. And so then this machine will send back a neighbor advertisement back saying okay, that's me, here is my MAC addresses.

So ICMP, although it is largely used for troubleshooting, there's quite a bit, but we also use it for other types of discoveries, and this neighbor solicitation and advertisement and router solicitation and advertisement is one example of that with the neighbor discovery protocol.