ICMP

Stands for: Internet Control Message Protocol

The protocol IP uses for error and diagnostic messages, like ping.

Internet Control Message Protocol (RFC 792) carries reachability errors and diagnostics rather than user data. Ping and traceroute are built on it, and a firewall's handling of ICMP shapes how a network reports problems.

RFC 792 (September 1981) makes it an integral part of IP that every IP module must implement, carried as protocol 1; ICMPv6 plays the same role in IPv6. Each message starts with type, code and checksum. Errors such as Destination Unreachable (type 3) and Time Exceeded (11) quote the IP header and at least 8 bytes of the packet that caused them, so the sender can match them; queries include Echo Request (8) and Echo Reply (0), the pair ping uses.

Traceroute reads the Time Exceeded each router returns when a probe's TTL runs out. Path MTU Discovery depends on Destination Unreachable code 4, Fragmentation Needed, which carries the next-hop MTU (Packet Too Big in ICMPv6); if it never arrives, the sender never shrinks its packets and connections stall once large data flows.

RFC 2979 (October 2000) notes that firewalls commonly block ICMP on the perception that it is a source of vulnerabilities, creating such black holes, and says a firewall that lets out packets with the Don't Fragment bit set must not block the Fragmentation Needed errors that answer them, while blocking Echo and Echo Reply is proper, if unfriendly. For ICMPv6, RFC 4890 lists what must not be dropped: Destination Unreachable, Packet Too Big, Time Exceeded code 0 and Parameter Problem codes 1 and 2. RFC 8900 (BCP 230) requires operators to keep Path MTU Discovery working, while letting implementations rate-limit the ICMP they generate.

Also known as: icmp

Sources

← All glossary entries