ICMP protocol full analysis

1. Introduction to ICMP

The full name of ICMP is (INTERNET CONTROL MESSAGE PROTOCOL) Network Control Message Protocol.

The protocol number of ICMP is 1.

ICMP messages are like the younger brothers of IP messages and always appear under the name of IP messages.

Because the ICMP message is inside the IP message, as shown in the figure:

ICMP belongs to the TCP/IP protocol family, works at the network layer (layer 3), and is used to transmit control messages between IP hosts and routers.

Control messages refer to network messages such as whether the network is connected, whether the host is reachable, whether the route is available, etc. Although these control messages do not transmit user data, they play an important role in the transmission of user data.

2. Typical application of ICMP—ping

A typical application of ICMP is Ping.

Ping is a common tool for testing network connectivity and can also collect other relevant information.

You can specify different parameters in the Ping command, such as the length of the ICMP message, the number of ICMP messages to be sent, and the timeout period for waiting for a reply response. The device constructs and sends ICMP messages based on the configured parameters to perform a Ping test.

Common configuration parameters for Ping are as follows:

• -a source-ip-address specifies the source IP address of the ICMP ECHO-REQUEST message. If the source IP address is not specified, the IP address of the outbound interface will be used as the source address of the ICMP ECHO-REQUEST message.
• -c count specifies the number of times to send ICMP ECHO-REQUEST messages. By default, 5 ICMP ECHO-REQUEST messages are sent.
• -h ttl-value specifies the TTL value. The default value is 255.
• -t timeout specifies the timeout for waiting for ICMP ECHO-REPLY after sending ICMP ECHO-REQUEST.

The output information of the Ping command includes the destination address, ICMP message length, sequence number, TTL value, and round-trip time. The sequence number is a variable parameter field included in the Echo reply message (Type=0), and the TTL and round-trip time are included in the IP header of the message.

3. Typical application of ICMP—Tracert

Another typical application of ICMP is Tracert.

Tracert tracks the packet forwarding path hop by hop based on the TTL value in the packet header.

In order to track the path to a specific destination address, the source first sets the TTL value of the message to 1.

After the message reaches the first node, the TTL times out, so the node sends a TTL timeout message to the source end, which carries a timestamp.

The source then sets the TTL value of the message to 2. The message times out after reaching the second node, and the node also returns a TTL timeout message, and so on, until the message reaches the destination.

In this way, the source end can track each node that the message passes through based on the information in the returned message, and calculate the round-trip time based on the timestamp information.

Tracert is an effective way to detect network packet loss and latency, and can also help administrators discover routing loops in the network.

The commonly used configuration parameters of Tracert are as follows:

• -a source-ip-address specifies the source address of the tracert message.
• -f first-ttl specifies the initial TTL. The default value is 1.
• -m max-ttl specifies the maximum TTL. The default value is 30.
• -name enables display of the host name of each hop.
• -p port specifies the UDP port number of the destination host.

4. ICMP Type

ICMP messages have two main functions: query messages and error messages.

For query messages, the commonly used ping command, as well as query messages used to obtain network subnet masks when booting a diskless system, and timestamp messages, the target host receives and returns a response packet in the corresponding format;

For error messages, the target host will not return the corresponding data packet in some cases:

5. Destination Unreachable Message

In daily life, mailing packages will go through multiple delivery links. If any link cannot be passed on, it will be returned to the sender with the reason why it cannot be delivered.

Similarly, when a router receives an IP message that cannot be passed on, it sends an ICMP destination unreachable message (Type 3) to the source sender of the IP message.

The Code in the message indicates the reason for the sending failure.

 Code  
 0 = net unreachable;  
 1 = host unreachable;  
 2 = protocol unreachable;  
 3 = port unreachable;  
 4 = fragmentation needed and DF set;  
 5 = source route failed.

6. Time Exceeded Message

During the process of network transmission of IP datagrams, if the TTL value of the IP data packet gradually decreases to 0, the datagram needs to be discarded.

At this time, the router needs to send an ICMP timeout message (Type is 11) to the source sender, with Code 0, indicating that a timeout occurred during the transmission process.

An IP datagram may be fragmented because it is too large, and then all the fragments are reassembled at the destination host.

If the host does not wait for all the fragment messages, it will send an ICMP timeout message to the source sender with Code 1, indicating that the fragment reassembly has timed out.

7. Parameter Problem Message

When a router or host processes a datagram and finds that it has to discard the message because of a parameter error in the message header, it needs to send a parameter error message (Type 12) to the source sender.

When Code is 0, the Pointer in the message indicates the byte position of the error.

8. Source Quench Message

The router will have a cache queue when processing messages.

If the maximum buffer queue is exceeded, the message cannot be processed and is discarded.

And send an ICMP source cooldown message (Type 4) to the source sender, telling the other party: "Hey, my place is full, please come back later."

9. Redirect Message

Imagine that in a company, someone comes to your project team and asks you where so-and-so is.

When you think about it, we don’t have this person in our group.

You will definitely say that we don’t have such a person in our group, so you should go to other groups.

When the router receives an IP datagram and finds that the destination address of the datagram is not in the routing table, it will send an ICMP redirect message (Type 5) to the source sender, reminding it that the address it wants to send to is not there and to look for it somewhere else.

10. Echo or Echo Reply Message

• Type (8) is a request echo message (Echo);
• Type (0) is an echo reply message (Echo Reply).
• Echo request or echo reply messages are query messages.
• Ping uses this type of message to query and respond.

11. Timestamp or Timestamp Reply Message

Timestamp messages are used to record the sending, receiving and transmission time.

• Originate Timestamp records the time when the sender sends the message;
• Receive Timestamp records the time when the receiver receives the message;
• Transmit Timestamp indicates the time when the last message was sent.

12. Information Request or Information Response

This message is used to find out the network number of a host (a host may be in multiple networks).

The destination address of the IP message header of the message will be filled with all 0s, indicating this, and the source address will be filled with the network IP where the source IP is located.

Okay, that’s all for today’s sharing~