The Network's Error Reporting System
ICMP (Internet Control Message Protocol) does not carry user data. It is not used to transfer files or load web pages. Instead, it is the mechanism by which network devices report errors and exchange operational information. Think of it as the network's built-in diagnostic system — the "check engine" light that tells you something went wrong and where.
ICMP messages are identified by a Type and a Code. The type identifies the broad category of message; the code provides detail within that category.
The most commonly encountered ICMP messages:
| Type | Name | Common Cause |
|---|---|---|
| 0 | Echo Reply | Response to a ping |
| 3 | Destination Unreachable | No route to host, port closed, firewall block |
| 8 | Echo Request | The ping itself |
| 11 | Time Exceeded | TTL expired in transit (used by traceroute) |
ping — Testing Reachability
ping sends an ICMP Echo Request (Type 8) to a target IP. If the packet arrives, the target's OS automatically responds with an ICMP Echo Reply (Type 0). The round-trip time tells you network latency; no reply means the host is unreachable, or a firewall is blocking ICMP.
traceroute — Mapping the Path
Every IP packet carries a TTL (Time to Live) field — a counter that decrements by 1 at each router. When TTL reaches 0, the router discards the packet and sends back an ICMP Time Exceeded (Type 11) message to the sender, including its own IP address.
traceroute exploits this by sending packets with TTL=1, then TTL=2, then TTL=3, and so on. Each router along the path reveals itself by sending back a Time Exceeded message. The result is a complete map of every hop from your machine to the destination, in order, each labeled with its own IP and the round-trip time it took to respond.
Key Point: Many production firewalls block ICMP entirely, believing it improves security. This is a double-edged decision. Blocking ICMP Echo Requests prevents ping-based host discovery, but it also breaks Path MTU Discovery — the mechanism by which TCP determines the largest packet size a network path can carry. Blocking ICMP Type 3 Code 4 ("Fragmentation Needed") causes silent, hard-to-diagnose TCP connection hangs. Blanket ICMP blocking is considered poor practice; selective filtering is preferred.