ICMP (Internet Control Message Protocol) is a network layer protocol used by routers and devices to send error messages and operational information about IP packet delivery. It is the foundation of two of the most common network diagnostic tools: ping and traceroute.
TL;DR — ICMP is not a transport protocol. It does not carry application data. Instead, it reports problems with IP packet delivery — unreachable hosts, exceeded TTL values, and fragmentation failures. Ping uses ICMP Echo Request and Echo Reply to test whether a host is reachable and measure round-trip time. Traceroute uses ICMP TTL Exceeded messages to map the path packets take across a network. ICMP operates at Layer 3 of the OSI model, alongside IP.
What ICMP does
When an IP packet fails to reach its destination — because a router can’t forward it, a host is unreachable, or the TTL expires — ICMP sends an error message back to the source IP. These messages help network devices and administrators understand what went wrong.
ICMP does not fix problems. It only reports them.
ICMP is defined in RFC 792 (IPv4) and RFC 4443 (ICMPv6 for IPv6). Every IP implementation is required to include ICMP support.
ICMP message types
Each ICMP message has a Type and a Code field that together specify the exact meaning.
| Type | Name | Common use |
|---|---|---|
| 0 | Echo Reply | Response to a ping |
| 3 | Destination Unreachable | Host, port, or network not reachable |
| 5 | Redirect | Router telling host of a better route |
| 8 | Echo Request | Ping outgoing request |
| 11 | Time Exceeded | TTL expired in transit (used by traceroute) |
| 12 | Parameter Problem | Bad IP header field |
Destination Unreachable codes
Type 3 (Destination Unreachable) uses codes to specify why:
| Code | Meaning |
|---|---|
| 0 | Network unreachable |
| 1 | Host unreachable |
| 2 | Protocol unreachable |
| 3 | Port unreachable |
| 4 | Fragmentation needed but DF bit set |
| 13 | Communication administratively prohibited (firewall block) |
Code 3 (Port unreachable) is what you receive when you connect to a UDP port with no listener. Code 13 is returned by firewalls that are configured to send ICMP rejections rather than silently drop packets.
How ping uses ICMP
Ping sends an ICMP Echo Request (Type 8) to a destination IP address and waits for an ICMP Echo Reply (Type 0).
$ ping 8.8.8.8PING 8.8.8.8: 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=118 time=11.4 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=10.9 ms64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=11.2 msWhat each field means:
- icmp_seq — sequence number, confirms packets arrive in order
- ttl — Time to Live remaining when the reply arrived (starts high, decrements at each hop)
- time — round-trip time in milliseconds
If ping returns no reply, the host is either down, unreachable, or has ICMP blocked by a firewall. A high time value indicates latency. Inconsistent times indicate jitter or packet reordering.
How traceroute uses ICMP
Traceroute maps the path a packet takes from source to destination by exploiting the TTL (Time to Live) field in IP packets.
How TTL works: Every IP packet starts with a TTL value (commonly 64 or 128). Each router that forwards the packet decrements the TTL by 1. When TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded (Type 11) message back to the source.
Traceroute algorithm:
- Send a packet with TTL=1 → the first router decrements to 0 and sends ICMP Time Exceeded. The source records the router’s IP and the round-trip time.
- Send a packet with TTL=2 → the second router sends ICMP Time Exceeded.
- Repeat, incrementing TTL by 1 each time, until the destination is reached (which sends ICMP Echo Reply) or the maximum hop count is hit.
$ traceroute azion.comtraceroute to azion.com (200.150.250.123), 30 hops max 1 192.168.1.1 1.2 ms 1.1 ms 1.0 ms (home router) 2 10.0.0.1 8.4 ms 8.6 ms 8.5 ms (ISP gateway) 3 72.14.215.165 11.2 ms 11.0 ms 11.3 ms (transit) 4 * * * (ICMP filtered) 5 200.150.250.123 18.7 ms 18.9 ms 18.6 ms (destination)* * * means a router did not respond — either it filtered ICMP or it does not send Time Exceeded messages. It does not necessarily mean a problem.
ICMP and TTL
TTL serves two purposes:
- Loop prevention — if a routing loop exists, packets would circulate indefinitely. TTL ensures they are eventually dropped.
- Traceroute — the controlled expiration at each hop is how traceroute identifies every router along a path.
The TTL value in a ping reply indicates how many hops the reply survived. A reply with TTL=118 from an initial TTL of 128 means the packet traversed 10 hops.
ICMP and security
ICMP flood attacks
An ICMP flood (ping flood) is a DDoS attack that sends large volumes of ICMP Echo Requests to overwhelm a target. Each request requires processing and a reply, consuming CPU and bandwidth.
The Smurf attack was a classic amplification variant: the attacker sends ICMP Echo Requests with a spoofed source IP (the victim’s IP) to a network’s broadcast address. Every host on the network replies to the victim simultaneously.
Modern networks disable directed broadcast and rate-limit ICMP to mitigate these attacks.
Should you block ICMP?
Blocking all ICMP is a common misconfiguration. It breaks:
- Path MTU Discovery (ICMP Type 3, Code 4 — required for TCP to work correctly across networks with different MTUs)
- Traceroute diagnostics
- Legitimate error reporting
The correct approach is to rate-limit ICMP rather than block it entirely, and to allow specific message types (Type 3 and Type 11) that are essential for network function.
ICMPv6
ICMPv6 (defined in RFC 4443) is the equivalent protocol for IPv6 networks. It handles the same error-reporting functions as ICMP but also takes on roles that separate protocols handled in IPv4.
| Function | IPv4 | IPv6 |
|---|---|---|
| Error reporting | ICMP | ICMPv6 |
| Address resolution | ARP (separate protocol) | ICMPv6 Neighbor Discovery |
| Router discovery | DHCP / manual | ICMPv6 Router Advertisement |
| Multicast management | IGMP (separate protocol) | ICMPv6 MLD |
ICMPv6 is mandatory in IPv6. Blocking ICMPv6 breaks basic IPv6 network operation.
Frequently asked questions
What is ICMP? ICMP (Internet Control Message Protocol) is a network layer protocol that devices and routers use to send error messages and diagnostics about IP packet delivery. It reports problems like unreachable hosts, expired TTL, and fragmentation failures. ICMP does not carry application data — it only carries control and error information.
What is the difference between ICMP and TCP/UDP? TCP and UDP are transport protocols that carry application data between endpoints. ICMP is a network layer protocol that reports errors and provides diagnostic functions. ICMP has no port numbers, no connection establishment, and no data payload — only message type, code, and header information from the failed packet.
How does ping use ICMP? Ping sends an ICMP Echo Request (Type 8) to a destination IP address and waits for an ICMP Echo Reply (Type 0). The round-trip time between sending the request and receiving the reply is the ping latency. If no reply arrives, the destination is unreachable, offline, or has ICMP filtered.
What does TTL mean in ping output? TTL (Time to Live) is a field in every IP packet that is decremented by 1 at each router hop. When TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded message. The TTL shown in ping output is the remaining TTL when the reply arrived — subtracting it from the starting TTL value reveals the number of hops.
What is an ICMP flood attack? An ICMP flood sends large volumes of ICMP Echo Requests to a target to exhaust its bandwidth or CPU. The target spends resources generating Echo Replies for each request. Rate-limiting ICMP at network edges and firewalls mitigates this attack.
Should firewalls block all ICMP? No. Blocking all ICMP breaks Path MTU Discovery, which is required for TCP connections to work correctly across networks with different MTU sizes. It also prevents traceroute and legitimate error reporting. The correct practice is to rate-limit ICMP and allow essential types (Type 3 Destination Unreachable and Type 11 Time Exceeded) while blocking or limiting Echo Requests if needed.
What is ICMPv6? ICMPv6 is the ICMP equivalent for IPv6 networks. In addition to error reporting, ICMPv6 handles functions that IPv4 assigned to separate protocols: ARP equivalent (Neighbor Discovery), router discovery (Router Advertisement), and multicast management (MLD). ICMPv6 is mandatory in IPv6 — blocking it breaks basic network operation.